I was asked to take a look at a family members' friends' Win2k3 server - Remote Desktop was no longer working, and they were trying to figure out why. This server is running Win2k3 SP2.
I determined that the License services were having some issues (Event ID 19, see http://support.microsoft.com/kb/2021885 for details) - this was fixed by installing a hotfix (http://support.microsoft.com/kb/983385) and reactivating licenses, so the error no longer appears. However, RDP connections from the Internet still fail.
The network hardware that is connected is a DSL modem to a SonicWALL TZ170 appliance, and that is connected to a 24 port switch which supplies wired access to one PC and 10 or 11 thin clients (Neoware).
Just to go over what was looked at:
1. Port 3389 is listening on the server (netstat -a -o shows ms-wbt-server is listening on 3389)
2. Portqry (from a remote Win7 system) shows that 3389 TCP is Listening, but 3389 UDP is listening or filtered (UDP only determines audio, doesn't it?)
3. I am able to telnet to the system from a remote Win7 system, to both the hostname/IP on port 3389 and connect fine.
4. RDP works locally (ie. plug in a laptop to the local LAN, mstsc connects just fine to the server with the laptop having an internal 192.168.0.x address)
5. A portscan using nmap on a remote system shows that 3389 is open.
6. I did not notice an antivirus on the Win2k3 system (not sure if it's running on the SonicWALL appliance, although I can't check that as they forgot the admin password, and I'd really like to avoid doing a factory reset on it). The local Windows firewall on the Win2k3 server is not enabled.
Connections to the server remotely gets this message:
This computer can't connect to the remote computer. Try connecting again. If the problem continues, contact the owner of the remote computer or your network administrator.
The Win2k3 server is well backlevel on fixes/patches from Windows Update, though - but why that would cause a problem when this was working before the license issue is beyond me..as the system had never had a full backup (just backups of the user data), I made an image of the drives before running the hotfix (just in case).
Any suggestions? I've done everything I can think of thats related to licensing, ports, etc. As it works locally but not over the Internet, the only thing I could think of was the Sonicwall was doing something (although the port forward seems to work fine to the internal IP of the win2k3 server, since it can see the service as its listening)..
Just at the end of my rope (and patience).
I'm not longer at the remote site at the moment, so I cannot check w/Wireshark - however, checking w/Wireshark remotely shows that the server does respond (SYN/ACK is done) but the connection just doesn't seem to come up.
As you can tell, I'm not that well versed in Win2k3; I'm mostly a UNIX guy. /grin
Port 443 is open on the SonicWALL as well, so I'm wondering if a TS Gateway is being used.
Modifying the RDP settings to use an RD Gateway (RD/TS, whatever!) does get me a certificate error from the Sonicwall - exporting that certificate and importing it into the Root Certs works, but trying to reconnect says the name (ie. CN) does not match - which makes sense, as the FQDN I'm connecting to doesn't match the cert name (the certificate that I received from the Sonicwall shows the internal IP of the Sonicwall 192.168.0.1, but not a full name).
Right! More confused now. /grin