Ok so after battling a few config options I finally have a new RDS environment running. Its on Server 2019 hosted in Azure, sitting behind an Azure WAF v2, with MFA authentication on the Gateway (using NPS extension). 

So evrything is working now, users can connect and all is behaving as it should, except for a small few users who are experiencing performance issues with slow performance, but only with published Remoteapp's. 

Just to confirm, the RDS servers are all very high spec and none of them are remotely approaching resource limits (none even going above 40%). Also one of the test machines experiencing performance is my own Desktop, an AMD Ryzen 9 3900X CPU with 64gb ram, 11gb RAM video card. Im pretty certain the local resources on this desktop are not a problem. However if I try to connect to a published remoteapp the redraw rate is very bad and it appears as if the connection is very laggy. Yet, it I connect to a remote desktop session (same environment, same servers, same everything) the performance is lightning quick. This lag only occurs with remoteapp.

Also to confirm its not a connection speed issue. I have 3 other Windows 10 devices here and performance on remote app and remote desktop session is fine, so theres no bandwidth issues from where Im connecting from.

If it helps, the clients experiencing issues are all Windows 10, fully patched and latest W10 build. However there are many other devices also W10 same build, same patch level that are fine. 

Has anyone experienced this before with Remoteapp's? Any suggestions?

In recent months we have had various RDS servers experiencing recurring issues with becoming unresponsive, in the sense that no users are able to log on to the RDS servers until the affected server(s) are power cycled.  

Overview: When the servers experience the issues RDP connection to the affected RDS server(s) will immediately display the "Please Wait for the Group Policy Client" message, and will hang at this message indefinitely until the server is power cycled.  When attempting to connect to the vCenter console of the affected server(s) a logon screen is displayed.  However, when attempting to log on to the console using either a Domain Admin or the server's local Administrator account it will indefiinitely hang at the "Please wait for the User Profile Service..." screen.  

When this issue occurs we are still able to remotely connect to the Event Viewer and Services console of the affected server(s), although we are unable to log on to the server.  The chain of events leading up to the issue in the event log always appears to start with the following unresponsive service error in the System log.  

"A timeout (30000 milliseconds) was reached while waiting for a transaction response from the ShellHWDetection service."

While this is always the first error event that seems to occur, there are also various other services displaying the same errors subsequently.  These events will continue recurring in the log, until the server is power cycled.  

A timeout (30000 milliseconds) was reached while waiting for a transaction response from the ShellHWDetection service. A timeout (30000 milliseconds) was reached while waiting for a transaction response from the wuauserv service. A timeout (30000 milliseconds) was reached while waiting for a transaction response from the BITS service. A timeout (30000 milliseconds) was reached while waiting for a transaction response from the CertPropSvc service. A timeout (30000 milliseconds) was reached while waiting for a transaction response from the Schedule service. A timeout (30000 milliseconds) was reached while waiting for a transaction response from the seclogon service. A timeout (30000 milliseconds) was reached while waiting for a transaction response from the SessionEnv service.

Additional Details: 

- When this issue occurs the CPU and RAM resource utilization on the server will be normal, and there will be a normal amount of user sessions on the server(s).  

- This issue has happened repeatedly for some of the same servers, but has happened for various RDS servers in multiple different 2008R2 RDS environments. 

- The resource utilization on the Domain Controllers is normal, and there are never any error or otherwise suspicious events in any of the logs on the Domain Controllers when this occurs.  

- When domain users log on to the RDS servers some redirected folders are in use at a DFS path.  We have tried restarting the DFS services when the issue occurs to no avail, although DFS was originally not a suspect since the issue only seems to happen to one server at a time.

- The problem seems to only happen to about one server at a time in an environment.  The remaining RDS servers in the farm(s) will allow users to log on to them normally.

- It has been reported that when the issue happens existing sessions for users on the affected server(s) will also become frozen and unresponsive, although we have not had a test account logged on at the time that the issue starts to confirm.  

- We tried disconnecting the NIC on the VM in vCenter so that it would not be able to attempt to contact a domain controller, and then logging on with the local Administrator account, but still get stuck at the same "Please wait for the User Profile Service..." screen.  

- We have tried disabling all GPOs that are linked to the OUs that the servers are in while the problem is happening, but it does not change anything. 

- Aside from the unresponsive service errors, no other obvious error events appear to be present when the problem starts.  

- The services that state show as being unresponsive in the event logs actually appear to be in a running state when the problem happens.  

- There are no individual users who have been logged on to the server each time when the problem happens. 

- The problem seems to have started within around the last 1 - 2 months (the first reports that we are currently aware of began coming in in Mid-October 2017.   

- Aside from regular Windows patching and application maintenance we are not aware of any notable changes in the environments in the recent past.  

We identified older articles which stated that issues with very similar, if not identical, issues had in the past been addressed with certain hotfixes.  However, the hotfixes referenced in the older articles no longer appear to be applicable, as they are outdated, and we have not been able to locate any newer hotfixes for these issues.  

For reference, the old hotfixes that both say that they are no longer applicable when attempting to install them are: 

https://social.technet.microsoft.com/Forums/lync/en-US/2c4b8121-da1c-4c11-b11d-2dff099ba245/windows-server-2008-r2-sp1-rds-hang-and-stop-responding-new-rdp-session-already-connected-session?forum=winserverTS

https://support.microsoft.com/en-us/help/2622802/the-group-policy-client-service-crashes-on-a-terminal-server-that-is-r

https://support.microsoft.com/en-us/help/2653810/security-group-filter-in-group-policy-preferences-does-not-remove-a-us

Has anyone recently seen any issues such as these and been able to identify fixes for them?

Server 2012 RDS Deployment.
Users have been facing slow remote app launches for months, so when they first log-in to RD Web and launch a remote app for the first time, it will take around 2-4 minutes for the app to open.

After spending hours on this , I have found that when logging in for the first time of the day or first time in a while, the Remote Desktop Gateway and RD Broker are trying to access the internet to check Certificate Revocation status using port 80. We do not allow outbound connections to the internet on port 80, so there are around 5/6 processes each time we log-on for the first time trying to reach the internet via HTTP, we then need to wait for these to time out one by one before the app launches.

I have seen this first hand, right after the processes timeout, the app launches.

I have found this document on MS, which seem to suggest to disable CRL checking, but this did not work.

https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd883258(v%3dws.10)

I guess my question is, how do I turn this off when using Remote Desktop Services as it is causing a major delay in log-on times, we do not want to open up outbound access on port 80.
I have yet to see a sold resolution to this question asked on technet either. 

Hi. We have a new WS2016 RDS deployment (VMs on Hyper-V):

 - 2x WS2016 RDGW in NLB

 - 2x RDCB in HA configuration

 - couple RDSH servers

The problem is that in 30-50% of the connection attempts via these gateways, the connection is stuck at the "Configuring remote session" message. The connection is never successfully estabilished when this happens and it is closed without any error couple minutes later. When you try again (or just immediatelly cancel the connection and reconnect), the connection may or may not go through.

When this problem happens, I can see there's single HTTP connection on the RDGW that accepted the connection with 0 bytes transferred in either direction. There are no related errors at this time.

Can anyone help? Btw. this problem also happens when connecting to a different single-host RDS deployment through these gateways.

I suspected the problem might be in the NLB, but removing either of the gateways from the NLB configuration (and from RDS farm) doesn't help, the issue is still there.

Rebooting the gateways helps for a short while (hours), but then the issue is back.

There are some other errors on the gateways, but these don't correlate to the connection attempts (event 210, source terminalservices-gateway: "Http transport: IN channel could not find a corresponding OUT channel" with no other details).

RDP clients are various ... W8.1, W10, Mac...

I just installed RDWebclient on our Windows Server 2016. I have it fully patched and have restarted the server since installing again. I uninstalled and reinstalled RDWebclient on the server. However, the web page is not displaying correctly. For instance, instead of display "Username" above the username input field, it says "USER_NAME_LABEL" and for password it says "PASSWORD_LABEL". In the top left hand corner, it says "ALL_RESOURCES_TAB_LABEL". Any help would be greatly appreciated. Thanks! (Sorry, I can't post a picture of it because my account is not validated).

So i will try my best to describe how my current setup is working. currently we have a local domain for our development team called dev.local and we have a oneway trust with our domain company.com which allows company.com users to log into dev.local machines. I have created an RDS server in dev.local but unable to have users to log into RDS as company.com users when not in the network. 

I have created a Group in Dev.local where i have all of the company.com users to be in and granted them access to the collections.

machines

rds.brk.dev.local has the gateway,broker, web, and license roles running windows server 2019

rds-01.dev.local is one of the remote app server (this belong to US collection) windows server 2019

rds-02.dev.local is the second remote app server (this belong to Canada collection) windows server 2019

we are using a certificate which is a wildcard from company.com so our public FQDN is devrds.company.com and all servers have the wildcard cert. 

If in the company.com network i am able to log in to remote apps with dev.local or company.com users without any issues. 

if i am outside the network i am able to login as dev.local users but not with company.com users as i get this error and users are able to browse the web url and see the apps in the portal from outside the network.


Can anyone help me as to why this isnt working correctly for company.com users outside the network?

Hey!

I hope you all are doing well.

Actually I was observing this issue for quite a long time. I use excel a lot and every time when I cut

or copy something, the feedback is same. Its always same and confusing and I just have to confirm whether I'm using the cut command or copy command.

Kindly fix this issue. When we use cut command, the text should just turn lite or something like that as it happens at other places. In excel, if you cut or copy something, the software feedback is just same.

Thanks

Greetings,

I'm looking to migrate an old RDS infrastructure to a more modern one. For this project we would like to dissociate notebook clients from the Internal AD and use Azure AD for them. I'm running in an issue with what seems to be the credential delegation part of the RDP connection. I am being prompted the user password when launching the application. If I type in type password the application launch just fine. 

I have followed these guidelines and defined "TERMSRV/*" in my delegation policy for diag purpose:

https://docs.microsoft.com/en-us/archive/blogs/mrsnrub/remote-desktop-services-websso 

My AAD Joined Windows 10 session is able to access protected Shares from my local AD without having to do anything.

The same RDS setup accessed with an AD Joined Win10 (same version, image from Azure) works properly, the credential delegation works on this setup, the password is not being requested. I have also forced the use of the RDS Gateway so that the AD client would use the same path as the AAD one.

This threads hints that it should have worked. Note that I'm not looking for the full SSO experience, just not having to enter the password when launching different applications.

I'm basically looking for pointers on where to look at, is there any traces that can be enabled that would give a reason to why the credential are not being pushed. Am I trying to do something that should not work?

Thanks for your input,
Dominic

Hi,

some of our users after the upgrade from Windows 10 1906 to 2004, are unable to connect to a RDS Farm (2012R2, a number of sessions host, 2 broker and  2 gateway).

When the user try to use the rdp file for the connection, the remote desktop client asks for the credential then it shows:

- Initiating remote connection...

- Preparing the destination computer...

- Securing remote connection...

After a while the client shows the following error:

Looking in the event viewer, the following warning / error are displayed in Microsoft-Windows-TerminalServices-ClientActiveXCore EventLog:

Other windows / mac / linux client works without problem.

Any help is really appreciated.

Thanks in advance.

Hi

We manage a few virtualized windows systems running a mix of windows server 2012R2 and windows server 2019

These are rather small deployments with 2-12 users.

All servers are deployed equally and have the following software installed

 - Active Directory Domain Services (The server acts as a domain controller for the users on the server)

 - Remote Desktop Services Connection Broker

 - Remote Desktop Services Session Host

 - Microsoft SQL server

 - Microsoft Office 2019 (SPLA)

 - Microsoft OneDrive for Business (Server 2019 VMs only)

Each customer has their own virtual server running the above software and the server runs AD for that specific customer only

I do know that this kind of setup is not officially supported by Microsoft, but it worked fine for Windows SBS solutions previously.

The installed versions of SQL server is 2012 SP4, except for one of the server 2019 instances where we have SQL server 2017 installed. The SQL server 2017 is a standard edition, while the others are express editions.

What we are experiencing, especially on the VM with server 2019 and SQL 2017 is that when windows has more that 300 active processes, it starts to give periodic slow downs where basic tasks like sending email, saving excel sheets or invoicing from their accounting software becomes unresponsive. A couple of minutes later, everything is back to normal for 5-10 minutes after which it all starts over again.

As the issue is most easy to reproduce on the server 2019 with SQL 2017, we have focused our current troubleshooting to here. In Microsoft terms this is still a rather small deployment with only 12 active users on the same server at once.

Until now we have tried to increase the resources given to the VM, which normally runs absolutely fine with 4 CPU cores and 24GB of RAM. As we saw a lot of processes sitting and waiting for response for either Exchange Online or Sharepoint Online, we recently increased this to 6 CPU cores to have additional resources available to handle these processes. With either 4 or 6 CPU cores, the users had these slow downs for about 15-25 minutes, but as of yesterday we increased to 12 CPU cores and are now at the cases experienced earlier with contious slow downs over a couple of minutes each.

We have already ruled out a disk performance problem as all virtual machines are running on mirrored nVME setup. From monitoring the storage we can see that there is no queue and no delays on the disks when the slow downs occur.

My theory at the moment is that Windows has a hard time dealing with the 300+ processes and throwing more CPU resources at the problem would not solve anything. But at the same time it seems a bit overkill to split a 12 user system into more servers

Does anyone have similar issues or experience with comparable strange slow downs?

Hi

I have a problem with a Windows 2012 R2 U1 RDS host session server.
Server is updated with latest updates.
Office 2013 32bit is installed per best practice.
Several other softwares are installed as well.
Installations was made using "change user /install"
Several GPOs are in place to restrict user from doing things like se drives start, Not run any exe files that are not allowed etc.
It is only one server and all userprofiles are local.
Outlook is used with cached exchange mode.

To the actual problem. Intermittently and with no pattern something happens that are related to "Windows Search" service.
The symptoms are one, or more, of the following.
1. Some or all icons on desktop become white.
2. Open My Computer freezes for about a minute up to a couple of minutes showing nothing.
3. Search doesn't work.
4. Tiles on the start screen becomes unresponsive and I cannot search here either. I have to logon into another session and either kill explorer.exe
   for the frozen user or restart Windows Search service.

When this happens it is like this for everyone and restarting Windows Search service clears it every time.
I also get Event ID 10023 and 10024 with Source Search.
I have tried to rebuild the index to no avail.
I get the notion that it has something to do with .OST files but I'm not sure of this.
The only thing that can be confirmed is that the error happens a lot more when there are more users logged on.

There are no other addins in Outlook other than standard.

Anyone have any ideas how I can continue troubleshooting this?

The issue described:
Intermittently and with no pattern something happens that are related to "Windows Search" service.
The symptoms are one, or more, of the following.
1. Some or all icons on desktop become white.
2. Open My Computer freezes for about a minute up to a couple of minutes showing nothing.
3. Search doesn't work.
4. Tiles on the start screen becomes unresponsive and I cannot search here either. I have to logon in another session and either kill explorer.exe for the frozen user or restart Windows Search service.

Office 2010 32bit is installed per best practice. Several other softwares are installed as well. Several GPOs are in place to restrict user from doing things like se drives start. It is only one server so all profiles are local. Outlook is used with online mode (not cached mode).

I get the following warning's in event log:

Hi, 

I'm facing this error "The remote session was disconnected because there are no Remote Desktop License Servers available to provide a license." while connecting remote desktop to the server (Windows Server 2012 R2).

Licensing mode was already configured, licenses were already installed and License Server was activated. But I still got errors in Licensing Diagnoser - Err 1. The licensing mode for remote desktop session host server is not configured, Err 2. The grace period for the remote desktop session host server has expired....

Any of my installed licenses are not issued to anyone. I have both Device and User CALs installed. I tried both and none is working.

Please advise how to solve this issue. As per advices from several forumns, I tried to delete "GracePeriod" registry Key but I cannot delete as Access was Denied! Please help. I've been struggling this for several weeks and none of the online tutorials seems to help me in this case. I followed following articles for Installation and configuration.

https://msfreaks.wordpress.com/2013/12/09/windows-2012-r2-remote-desktop-services-part-1/

http://www.wackytechtips.com/installing-and-configuring-remote-desktop-services-rds-on-windows-server-2012/

Thanks in advanced.

About two weeks ago, the UWP, iOS, Mac OS and Android versions of Microsoft Remote Desktop Manager all stopped working for our RDS environment externally; previously, users were able to use this application externally and internally without fault.  If the users access our RDWeb/Pages/en-US/default.aspx and use classic MSTSC to open RemoteApps then this works externally.

When plumbing in the correct feed details to the apps we get (iOS, Mac OS) 'no workspace is associated with this URL site'.

We are using Windows Server Datacenter 2016 across the board with 2 servers acting as Gateways, Licensing, Broker and Web Access with a further 6 acting as session hosts.  All have been updated including the most recent crypto hotfix (approximately when the whole thing stopped working).

The route external users take would be:

External DNS entry - ADFSWAP - Gateway - Broker - Session Host

The following error can be found in the logs on our gateway servers:

- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System><Provider Name="ASP.NET 4.0.30319.0" /> <EventID Qualifiers="32768">1309</EventID> <Level>3</Level> <Task>3</Task> <Keywords>0x80000000000000</Keywords> <TimeCreated SystemTime="2020-01-28T09:09:11.513985500Z" /> <EventRecordID>135104</EventRecordID> <Channel>Application</Channel> <Computer>##gateway computer##</Computer> <Security /> </System>
- <EventData><Data>3005</Data> <Data>An unhandled exception has occurred.</Data> <Data>28/01/2020 09:09:11</Data> <Data>28/01/2020 09:09:11</Data> <Data>b06bd32f8e5749749acc0c7da21c3816</Data> <Data>78</Data> <Data>13</Data> <Data>0</Data> <Data>/LM/W3SVC/1/ROOT-1-132246739255801381</Data> <Data>Full</Data> <Data>/</Data> <Data>C:\inetpub\wwwroot\</Data> <Data>##gateway computer##</Data> <Data /> <Data>7564</Data> <Data>w3wp.exe</Data> <Data>IIS APPPOOL\DefaultAppPool</Data> <Data>HttpException</Data> <Data>A potentially dangerous Request.Path value was detected from the client (:). at System.Web.HttpRequest.ValidateInputIfRequiredByConfig() at System.Web.HttpApplication.PipelineStepManager.ValidateHelper(HttpContext context)</Data> <Data>https://fqdn:443/https:fqdn/api/feeddiscovery/webfeeddiscovery.aspx</Data> <Data>/https:/fqdn/api/feeddiscovery/webfeeddiscovery.aspx</Data> <Data>##Internal IP##</Data> <Data /> <Data>False</Data> <Data /> <Data>IIS APPPOOL\DefaultAppPool</Data> <Data>26</Data> <Data>IIS APPPOOL\DefaultAppPool</Data> <Data>False</Data> <Data>at System.Web.HttpRequest.ValidateInputIfRequiredByConfig() at System.Web.HttpApplication.PipelineStepManager.ValidateHelper(HttpContext context)</Data> </EventData></Event>

Anyone got any ideas?  The above has had some data annonymised for security.

Can't connect to different 2019 RDS farms from the RD Web Site launched from a server OS. The connection hangs on starting for minutes, before getting a general error that the connection can not be established.

Have this problem from several server OS (2012 R2, 2019), and have tried different browsers. Have not this problem when connecting from a Windows 10 client, so it must be something with the Remote Desktop Connection App on all server OS.

Thank you in advance for any hint or advice.

Franz