Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have several W2K3 SP2 servers, admin TS enabled. I discovered this morning, I was unable to logon into some of them. I've a couple of Citrix servers in different farms, a SAP (IA64) app server and a cvs server. All of them show same sympthoms; remote connections are refused. I've been able to logon locally, and terminal server service is up, there are no users (so connections are not depleted).

There are no errors in log in most servers. One of the Citrix ones, reported following errors:

Event ID    50
Source  TermDD
Type    Error
Description The RDP protocol component X.224 detected an error in the protocol stream and has disconnected the client.


Event ID    1006
Source  TermService
Type    Error
Description The terminal server received large number of incomplete connections.  The system may be under attack.

Anyway, I suppose these errors appear because server isn't working, and Citrix users try to logon massively. (I nmap'ed server and port seems up).

I've solved this problem rebooting before, but with so many servers affected it seems like a crappy workaround. Any idea about troubleshooting it properly?

share|improve this question

Just wondering whether rebooting does fix the issue (even temporarily)?

Also, in the event of someone trying to brute force attack the rdp port to find the password of a user which can remotely login: Check to make sure that Group/Account policies haven't locked the account out of remote access. (Should this feature be enabled)

Good Luck!

share|improve this answer

Here's a question posted on about a similar problem:

The only problem is the M### don't link to the MS articles on MS website, but on the (same) articles on, so you'll have to figure out which MS articles they apply to (or become a subscriber, not sure if it's free, didn't check).

share|improve this answer
I'd already checked eventid site without success before posting here. My problem is similar to this one,… but it doesn't happen after reboots. I've checked private hotfix, but I'm not sure about it. – satch Sep 14 '09 at 14:32

I recently found that TS got problems with connecting when Advantage Validation Tool is not installed properly, Just guesting You may check that part of software on yours WIN2K ore they get automatic updates which is locked system because problems with WGAs

share|improve this answer

I've seen multiple Windows 2003 terminal servers have this problem. For me they have all been machines with more than one network interface or a multiport interface. If you go to Terminal Services Configuration (tscc.msc) and go to properties on your RDP-Tcp connection there is a tab for Network Adapter. Change this option from "All network adapters" to the network adapter you use for front end connections.

share|improve this answer

Never happened to me, but maybe it could be a network issue?

share|improve this answer
I could traceroute to all of them without problems. Nmap reveals port 3389 is listening. I could telnet to 3389 and when I type I get disconnected. I read about a terminal server problem related to MTU but was a SP1 or pre-SP1 issue. I tried to access from several different clients, some of them located on same subnet without success. – satch Sep 14 '09 at 13:18

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.