Yesterday a customer complain about he couldn´t connect using MSTSC client to a Win2008R2 hosted on Amazon AWS/EC2
The error was on event log, but only one time, but the user says that he tried more than 5 times, allways with the same error message and the TS logs shows all retries of the user, but only one Event ID 56 was in the event log. There are several Event IDs 1149 (Remote Desktop Services: User authentication succeeded) in the log showing his attemps (more thant 9), but only one event ID 56 in the event logs, all Event IDs 1149 showing login OK and for several hours it was working and suddenly stops, after the Event ID 56
We had this problem in the past (event ID 56), and was related to the traffic it was flowing through a (very very busy) fortigate appliance and after removing the fortigate the problem never happened again. IN this case, there was a fortigate also, but only making traffic flow through a VPN, not the same thing and during the diagnostic, two new information: There was a change in fortigate changing cluster mode from A-A to A-P AND the user tried also to connect from a Amazon Workspace (VDI) inside the Amazon Network and the problem ocurred again, even fortigate having (apparently) nothing to do with the matter.
I could connect with no problem through the fortigate VPN from a remote network using my domain user and the local useranme the user was trying to use it was a local user, in a disconnected state running several LOB APP services (don´t laugh) and i couldn´t disconnect/logoff the user, nor reboot the server.
This error is new to me. In the past we had several TermDD Event ID 56 errors, but it´s the first time i see this specific error:
>\temp\err\err.exe C000020D --> FIRST TIME, after the fortigate change
# for hex 0xc000020d / decimal -1073741299 :
STATUS_CONNECTION_RESET ntstatus.h
# The transport connection has been reset.
# 1 matches found for "C000020D"
>\temp\err\err.exe C0000184 --> 2 or 3 times in the last 4 months
# for hex 0xc0000184 / decimal -1073741436 :
STATUS_INVALID_DEVICE_STATE ntstatus.h
# The device is not in a valid state to perform this request.
# 1 matches found for "C0000184"
>\temp\err\err.exe C000005E --> 2 or 3 times in the last 4 months
# for hex 0xc000005e / decimal -1073741730 :
STATUS_NO_LOGON_SERVERS ntstatus.h
# There are currently no logon servers available to service
# the logon request.
# 1 matches found for "C000005E"
>\temp\err\err.exe C00A0032 --> 2 or 3 times in the last 4 months
# for hex 0xc00a0032 / decimal -1073086414 :
STATUS_RDP_PROTOCOL_ERROR ntstatus.h
# The RDP protocol component %2 detected an error in the
# protocol stream and has disconnected the client.
# 1 matches found for "C00A0032"
>\temp\err\err.exe C00000DC --> 2 or 3 times in the last 4 months
# for hex 0xc00000dc / decimal -1073741604 :
STATUS_INVALID_SERVER_STATE ntstatus.h
# Indicates the Sam Server was in the wrong state to perform
# the desired operation.
# 1 matches found for "C00000DC"
The source for the err application was taken from: https://blogs.technet.microsoft.com/askperf/2010/03/24/the-curious-case-of-event-id-56-with-source-termdd/
Why does the EventID 56 shows only once, but the user reported several attempts of the error?
Maybe the network really is a problem?
