Rdp an internal error has occurred windows server 2016

Столкнулся со странным сообщением “
Произошла внутренняя ошибка
/
An internal error has occurred
” при RDP подключении к недавно развернутому серверу RDSH на Windows Server 2012 R2 из Windows 10. Буквально вчера RDP подключение к серверу работало нормально, но после установки и настройки RemotApp приложений и перезагрузки сервера, я не могу удаленно подключиться к его рабочему столу. Служба Remote Desktop Services судя по всему работает, так как пароль пользователя при подключении запрашивается.

Как я понял, сообщение RDP консоли “Произошла внутренняя ошибка” может появляться в различных случаях и иметь совершенно различные причины, связанные как с сервером Remote Desktop, так и с клиентом. В этой статье я постарался собрать все варианты решения и сценарий, который помог мне.

Картинка с сайта: winitpro.ru

В первую очередь, убедитесь, что на RDS сервере доступен RDP порт 3389, и подключение не блокируется файерволом (Test-NetConnection rdsserver –port 3389).

Изучив логи RDP подключений на удаленном RDS сервере, я не увидел никаких особенных ошибок. В журнале Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational видно, что RDP сессия создается:

The server accepted a new TCP connection from client 10.10.1.60:64379.
Connection RDP-Tcp#3 created

Но потом без какой-либо ошибки RDP сеанс завершается:

The server has terminated main RDP connection with the client.
The disconnect reason is 0

Картинка с сайта: winitpro.ru

Проверьте состояние службу Remote Desktop Services на удаленном сервере и перезапустите ее. Вы можете удаленно перезапустить службу через консоль Services.msc (Connect to another computer), но гораздо проще проверить состояние службы и перезапустить ее через PowerShell:

(Get-Service TermService -ComputerName msk-ts1).status

Служба запушена (Running), перезапустим ее:

Get-Service TermService -ComputerName msk-ts1| Restart-Service –force –verbose

Картинка с сайта: winitpro.ru

Но проблему это не решило.

Какие еще варианты решения проблемы мне удалось найти в сети:

1. Если у вас на удаленном сервере установлен КриптоПРО, он может быть источником проблем с rdp подключением. Попробуйте отключить проверку контрольных целостности файлов (проверки контрольных сумм) в КриптоПро через реестр. Перейдите в ветку реестра
   HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\CProIntegrity
   и измените значение параметра CheckMode на 0. Перезагрузите сервер.
2. Если в журнале событий TerminalServices-RemoteConnectionManager вы встретите событие с EventID 1057 (The RD Session Host Server has failed to create a new self signed certificate to be used for RD Session Host Server authentication on SSL connections), перейдите в каталог
   C:\ProgramData\Microsoft\Crypto\RSA
   , переименуйте папку Machinekeys в Machinekeys_bak и перезапустите службу TermService.
3. Также нашел информацию, что RDP проблема “Произошла внутренняя ошибка” встречалась в Windows 10 1809, если на удаленном компьютере включена политика Configure H.264/AVC hardware encoding for Remote Desktop connections (находится в секции GPO: Computer Configuration -> Administrative Templates -> Windows Components -> Remote Desktop Services -> Remote Desktop Session Host -> Remote Session Environment). Для решения этой проблемы достаточно отключить UDP протокол для RDP, создав в ветке реестра
   HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\Client
   параметр
   fClientDisableUDP
   со значением 1.
4. В комментариях Ivan оставил очень полезный фикс.
   Проблема с ошибкой RDP может быть в наличии некоего счетчика учитывающего максимальное количество подключений в Windows.
   В десктопных версиях Windows — 100, в Windows Server -3000. Для сброса счетчика достаточно перезагрузить компьютер, или просто увеличить лимит через реестр:
   REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v MaxOutstandingConnections /t REG_DWORD /d 65536

Ни один из рассмотренных выше сценариев не был применим в моем случае. Я совершенно случайно обнаружил, что с других компьютеров нет проблем с подключением к этому RDS серверу. Значить проблема только с моим компьютером, а не с сервером.

Я очистил историю RDP подключений в ветке
HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers
и сбросил кэш RDP в каталоге
C:\Users\%Username%\AppData\Local\Microsoft\Terminal Server Client\Cache
(перед удалением закройте все запущенные сеансы mstsc.exe):

del "C:\Users\%Username%\AppData\Local\Microsoft\Terminal Server Client\cache"

Картинка с сайта: winitpro.ru

После этого перезагрузил свой компьютер, и ошибка RDP подключения исчезла!

Yesterday I was faced with an error while trying to connect to a Windows 2016 Server hosed in AWS (EC2):

An internal error has occurred.

The only “change” that had been made recently was the installation of .NET Framework 4.8.

I found some articles pointing to possible solutions, but without access to the console it was going to prove difficult to diagnose and resolve!

My first port of call was checking the event log. Fortunately windows event viewer supports connecting to a remote computer:

Картинка с сайта: tickett.wordpress.com

When trying to establish a Remote Desktop Connection an error was appearing in the System log (coming from Schannel):

A fatal error occurred when attempting to access the TLS server credential private key. The error code returned from the cryptographic module is 0x8009030D. The internal error state is 10001.

Google found a few suggestions (including some changes to my local client registry) but no initial joy. Then I found this TechNet article which sounded a bit more promising: https://social.technet.microsoft.com/Forums/en-US/0d2da30b-4876-45c1-99d1-1e89a12c1e86/an-internal-error-has-ocurred-error-when-i-try-to-rdp-onto-a-2012-r2-server?forum=winserver8gen

The challenge was then figuring out how to apply this change remotely… Initially I didn’t even have the Group Policy Object Editor available on my machine (Windows 10 Home). But a quick script was able to add it:

dir /b %SystemRoot%\servicing\Packages\Microsoft-Windows-GroupPolicy-ClientExtensions-Package~3*.mum >List.txt 
dir /b %SystemRoot%\servicing\Packages\Microsoft-Windows-GroupPolicy-ClientTools-Package~3*.mum >>List.txt 

for /f %%i in ('findstr /i . List.txt 2^>nul') do dism /online /norestart /add-package:"%SystemRoot%\servicing\Packages\%%i" 
pause

You need to save the script with a .bat extension and run/execute. Great now we can launch the local policy editor, but no apparent option to connect to a remote computer!

Some more googling… great it looks like when using Microsoft Management Console (mmc) you can add the component and have the option to connect to a remote computer (there is also a command line argument):

gpedit.msc /gpcomputer:Computername

But damn, Access Denied and no prompt/option to enter credentials! Fortunately, I commonly need to launch applications (such as SQL Server Management Studio, Visual Studio etc) with remote credentials so I have a trick up my sleeve!

runas /netonly /user:remote-machine\username cmd

We now have a shell running with the remote administrator’s credentials. From here we can launch mmc or gpedit.msc and connect to the remote computer!

I was successfully able to change the remote policy. Under Computer Configuration, Administrative Templates, Windows Components, Remote Desktop Services, Remote Desktop Session Host, Security, set Require use of specific secuirty layer for remote (DGP) connections to Enabled and select RDP from the Security Layer options dropdown.

I wasn’t able to quickly find a way to execute gpupdate on the remote machine (I know I could have used something like psexec, but didn’t have that to hand), but was able to reboot the server gracefully simply by executing:

shutdown /r /m \\remote-machine /t 0

Voila! We’re back in business.

I think some of the credential issues could also been able averted by creating a user on my local computer with the same username/password as the remote administrator account. Then logging in to my local computer with that account.

Good luck!

In some cases, when connecting to a remote computer or RDS host via Remote Desktop Connection (RDP), users may encounter an “An internal error has occurred” error. This error can occur for a number of reasons related to both the RDP/RDS server and the client settings, and usually shows after user credentials are entered in the mstsc.exe window or immediately after the Connect button is clicked.

Картинка с сайта: theitbros.com

As there are several possible causes for this internal RDP error, try the following tips one by one until you find a solution that will help you.

Check the Remote Desktop Settings on the Client Device

If the “An internal error has occurred” error is only showing on one computer and other clients are successfully connecting to the Remote Desktop host, you need to check the settings on the current client device.

Reset the DNS client cache on your computer by running the following command from an elevated command prompt:

ipconfig /flushdns

If you have entered the hostname or FQDN of the remote computer in the RD Client window, try to establish an RD connection using an IP address. If the Remote Desktop IP connection is successful, use the nslookup command to check that the DNS settings on your computer are correct:

nslookup yourRDShost

Hint. If the DNS settings are not configured correctly, the Remote Desktop can’t find your computer error will appear.

Then check that the default RDP port (TCP/3389) is available on the remote server and the connection is not blocked by a firewall. Open the PowerShell console and run the command:

Test-NetConnection yourRDShost -port 3389

This command will return TcpTestSucceeded: True if the RDP port is not blocked.

Картинка с сайта: theitbros.com

If you are using a VPN to connect to a remote network, try disabling the VPN connections and try reconnecting to the RDP host. You can find and disable all active native Windows VPN connections using PowerShell:

foreach ($item in get-vpnconnection | where { $_.ConnectionStatus -eq "Connected" })

{

Rasdial $item.Name /disconnect

}

If you are using third-party VPN software, disconnect VPN sessions from its interface.

Open the properties of your RDP connection in Remote Desktop Connection windows (mstsc.exe) and make sure the ‘Reconnect if the connection is dropped‘ option is enabled on the Experience tab.

Картинка с сайта: theitbros.com

Also, try to disable the Server Authentication warning in the Advanced tab of the RDC client. Set the If server authentication fails to Connect and don’t warn me.

Check the Security Event Log for the following event ID 5379:

Credential Manager credentials were read.

This event occurs when a user performs a read operation on stored credentials in Credential Manager.

Your RDP client may have tried to use saved RDP credentials to connect. You should try removing the saved password from Windows Credential Manager:

1. Open the Windows Credentials via the Control Panel. Or by running the command:

   rundll32.exe keymgr.dll,KRShowKeyMgr

2. Delete the saved RDP logon credentials for your remote host. Find the entry that starts with TERMSRV\your_rdp_host_name or TERMSRV\your_rdp_IP_address and click the Remove button;

Use the following batch script to clear the RDP cache on the client:

@echo off

reg delete "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default" /va /f

reg delete "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers" /f

reg add "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers"

attrib -s -h %userprofile%\documents\Default.rdp

del %userprofile%\documents\Default.rdp

del /f /s /q /a %AppData%\Microsoft\Windows\Recent\AutomaticDestinations

del /f /s /q /a "%userprofile%\AppData\Local\Microsoft\Terminal Server Client\Cache"

Save this code to the reset_mstsc_cache.bat file and run it as an administrator.

Картинка с сайта: theitbros.com

Next, check the settings on the RDP host side if none of these tips work.

Check the Remote Desktop Host Settings

If the Remote Desktop connection error occurs on all clients, the simplest way to resolve the problem is to reboot the remote RDP/RDS host.

If you cannot restart the RD host immediately, you should try to restart the Remote Desktop Service (along with the Remote Desktop Services UserMode Port Redirector). You can do this with the following commands running in the elevated cmd.exe:

net stop termservice

net start termservice

Or you can restart Remote Desktop Services from the services.msc console.

Картинка с сайта: theitbros.com

If the problem disappeared after a restart, but it reappears after a while, then you need to try to change the settings of the RD Session host.

Use GPO to Fine-tune the RD Host Settings

Try to change some Group Policy settings using the Local GPO editor (gpedit.msc) or domain Group Policy Management Console (gpmc.msc).

1. Disable UDP protocol for RDP connections. Navigate to Computer Configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Connections, enable the policy Select RDP transport protocols and set Select Transport Type = Use only TCP. This will completely disable the use of UDP for RDP connections;
   

   Картинка с сайта: theitbros.com

2. The error “An internal RD error has occurred” often only occurs on clients that are connected to the network via a VPN tunnel. It seems that the problem is caused by the fragmentation of the UDP packets in the VPN tunnel. To disable RDP over UDP on a specific client only, enable the following GPO option on that computer: Off UDP on Client = Enabled under Computer configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Connection Client > Turn Off UDP on Client = Enabled;
   

   Картинка с сайта: theitbros.com

3. Enable FIPS compliant algorithms: Computer configuration > Windows Settings > Security Settings > Local Policies > Security Options > System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing = Enabled;
   

   Картинка с сайта: theitbros.com

4. Disable the hardware encoding and enforced AVC:444 mode on the RDP server side: Computer configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Remote Session Environment > Prioritize H.264/AVC 444 Graphics mode for Remote Desktop Connection = Disabled;
   

   Картинка с сайта: theitbros.com

5. Try to adjust the RDP security level to RDP mode. Enable the policy ‘Require use of specific security layer for remote connections’ under the GPO section Computer configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Security and set the Security level to RDP (according to the article). Restart the remote host to apply this setting.

After changing the local Group Policy settings on a remote server, you need to apply them on the client and server using the gpupdate command.

Check Network Level Authentication

To secure RDP connections, Network Level Authentication (NLA) is enabled by default on the RD host. In some cases, NLA can prevent RD connections from legacy or incompatible devices. You can temporarily disable NLA and see if the insecure remote desktop connection works as one of the troubleshooting steps.

Картинка с сайта: theitbros.com

Network Settings on Remote Desktop Host

If you are using NIC Teaming (bonding) on your Windows Server host, make sure that the receive side scaling is disabled.

1. Open the Device Manager console (devmgmt.msc);
2. Expand the Network adapters and open the properties of the Microsoft Network Adapter Multiplexor Driver;
3. Go to the Advanced tab and set Receive Side Scaling to Disabled.
   

   Картинка с сайта: theitbros.com

You can try to change the maximum outstanding connections limit on your RDP server via the registry. Set the following registry value via regedit.exe:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server

DWORD: MaxOutstandingConnections

VALUE: 10000

Or with PowerShell:

New-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server" -Name MaxOutstandingConnections -Value 10000 -PropertyType DWORD -Force

Check the current MTU size in your Windows with the command:

netsh interface ipv4 show subinterfaces

Картинка с сайта: theitbros.com

RDS Certificates

When you use a smart card certificate to authenticate on the Remote Desktop server, you may encounter the following events in the RemoteDesktopServices-RdpCoreT log on the Windows Server 2019/2016 RDS host:

Warning Event 226, RemoteDesktopServices-RdpCoreTS

General: RDP_TCP: An error was encountered when transitioning from StateUnknown in response to Event_Disconnect (error code 0x80070040)

Warning Event 142, RemoteDesktopServices-RdpCoreT

General: TCP socket READ operation failed, error 64

Make sure your certificate has not been revoked.

Next, try to recreate the RDP certificate:

1. Open the local computer certificates MMC snap-in (run the certlm.msc command);
2. Go to the following certificate section: Remote Desktop > Certificates;
3. Right-click your self-signed certificate RDP cert and delete it (if there are several RDP certs, remove them all);
   

   Картинка с сайта: theitbros.com

4. Restart the Remote Desktop Services as described above.

RDP and TLS Encryption

If you have disabled the legacy Transport Layer Security (TLS) 1.0 and TLS 1.1 protocols on your RD host, this may cause an Internal error when attempting to establish an RD connection to an RDS farm with the Connection Broker. The reason for this problem is that the Windows Internal Database (WID), which is used by default on an RDCB host running Windows Server 2016/2012 R2, only supports TLS 1.0.

To solve the problem, you can:

• Use an external Microsoft SQL Server with TLS 1.2 support for the RD Connection Broker database.
• Or you need to enable the TLS 1.0 protocol on RDCB:

reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server" /v Enabled /t REG_DWORD /d 1 /f

Now check if your RDP client connects to the remote host without errors.