RDP users (Citrix XenApp) are getting connections refused/dropped and a black screen. This is Citrix MCS spawned terminal services on Windows Server 2012 R2. On the server seeing these messages:
Log Name: Microsoft-Windows-TerminalServices-LocalSessionManager/Operational Source: Microsoft-Windows-TerminalServices-LocalSessionManager Date: 5/7/2019 12:08:15 PM Event ID: 36 Task Category: None Level: Error Keywords: User: SYSTEM Computer: CTXIAHYP004.mydomain.com Description: An error occurred when transitioning from CsrConnected in response to EvCsrInitialized. (ErrorCode 0x80004005) Log Name: Application Source: Microsoft-Windows-Winlogon Date: 5/7/2019 12:08:15 PM Event ID: 4005 Task Category: None Level: Error Keywords: Classic User: N/A Computer: CTXIAHYP004.mydomain.com Description: The Windows logon process has unexpectedly terminated.
After extensive Internet search with these symptoms I am coming up empty.
I reviewed EventTracker and related MicrosoftHelp but these recommendations do not seem to apply in this case or are too vague to be useful. Those articles suggest a server resource constraint (we do not see this, unless it was temporary and is no longer present when the system event occurs), registry corruption (this seems very unlikely, but even if true, how do we determine which registry hive or key is corrupt?) or a service that needs restarting (which service? we do not see any errors showing failed or stopped services).
Any other tips?