A
Andrew_242
Hello All,
I am provisioning a a Windows 10 Enterprise workstation for my company it is a clean install of the OS. The version of windows that is installed is build 10.0.14393.3053. I have the device connected to our network here which is private. Since the first time that I put the device on to the network I have been unable to RDP into it via a Windows 7 Pro workstation that I use for work. Both devices are part of the same domain, I am able to remote from the Windows 10 workstation to the Windows 7 workstation but not the other way around. I have followed several suggestions from MS and also from technet forums with no success. Remote setting are set to allow remote connections and to use NLA. I am unable to access the advanced options for the remote settings because it is grayed out. I also, do not have the option to enable remote access setting as it is also grayed out. The RemoteDesktopServices as well as the Remote Desktop Services Usermode Redirector are both running and set to automatic. The workstation has been patched with all updates available to this build. I have viewed the event logs under EventViewer>Applications and Services log>Microsoft>Windows>RemoteDesktopServices>RdpCoreTs/Operational and it appears that the workstations attempt to connect but the connection is dropped almost immediately. I have been troubleshooting it for a few days now and I have gotten nowhere it seems. I have included the information that I collected from Event Viewer from the time the connection is established to the time it is disconnected from the client. I have removed the name of the workstation for security purposes.
These are the entries that I see in EventViewer>Applications and Services log>Microsoft>Windows>RemoteDesktopServices>RdpCoreTs/Operational
Information
Event 131, RemoteDesktopServices-RdpsCoreTS
General
The server accepted a new TCP connection from client 172.20.27.118:57276.
[ Name] Microsoft-Windows-RemoteDesktopServices-RdpCoreTS
[ Guid] {1139C61B-B549-4251-8ED3-27250A1EDEC8}
EventID 131
Version 0
Level 4
Task 4
Opcode 15
Keywords 0x4000000000000000
- TimeCreated
[ SystemTime] 2019-08-21T16:18:58.517269000Z
EventRecordID 1159
- Correlation
[ ActivityID] {F42025B4-701E-4D3A-868E-96285FB50000}
- Execution
[ ProcessID] 576
[ ThreadID] 1796
Channel Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational
Computer
- Security
[ UserID] S-1-5-20
- EventData
ConnType TCP
ClientIP 172.20.27.118:57276
==============================================================================================================
Event 65, RemoteDesktopService-RdpsCoreTS
General
Connection RDP-Tcp#0 created
[ Name] Microsoft-Windows-RemoteDesktopServices-RdpCoreTS
[ Guid] {1139C61B-B549-4251-8ED3-27250A1EDEC8}
EventID 65
Version 0
Level 4
Task 4
Opcode 13
Keywords 0x4000000000000000
- TimeCreated
[ SystemTime] 2019-08-21T16:18:58.519989200Z
EventRecordID 1160
- Correlation
[ ActivityID] {F42025B4-701E-4D3A-868E-96285FB50000}
- Execution
[ ProcessID] 576
[ ThreadID] 1792
Channel Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational
Computer
- Security
[ UserID] S-1-5-20
- EventData
ConnectionName RDP-Tcp#0
====================================================================================================================
Event 72, RemoteDesktopService-RdpsCoreTS
General
Interface method called: PrepareForAccept
[ Name] Microsoft-Windows-RemoteDesktopServices-RdpCoreTS
[ Guid] {1139C61B-B549-4251-8ED3-27250A1EDEC8}
EventID 72
Version 0
Level 4
Task 4
Opcode 13
Keywords 0x4000000000000000
- TimeCreated
[ SystemTime] 2019-08-21T16:18:58.522375300Z
EventRecordID 1161
- Correlation
[ ActivityID] {F42025B4-701E-4D3A-868E-96285FB50000}
- Execution
[ ProcessID] 576
[ ThreadID] 368
Channel Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational
Computer
- Security
[ UserID] S-1-5-20
- EventData
MethodName PrepareForAccept
====================================================================================================================
Event 72, RemoteDesktopService-RdpsCoreTS
General
Interface method called: SendPolicyData
Name] Microsoft-Windows-RemoteDesktopServices-RdpCoreTS
[ Guid] {1139C61B-B549-4251-8ED3-27250A1EDEC8}
EventID 72
Version 0
Level 4
Task 4
Opcode 13
Keywords 0x4000000000000000
- TimeCreated
[ SystemTime] 2019-08-21T16:18:58.522390200Z
EventRecordID 1162
- Correlation
[ ActivityID] {F42025B4-701E-4D3A-868E-96285FB50000}
- Execution
[ ProcessID] 576
[ ThreadID] 368
Channel Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational
Computer
- Security
[ UserID] S-1-5-20
- EventData
MethodName SendPolicyData
====================================================================================================================
Event 141, RemoteDesktopService-RdpsCoreTS
General
PerfCounter session started with instance ID 0
[ Name] Microsoft-Windows-RemoteDesktopServices-RdpCoreTS
[ Guid] {1139C61B-B549-4251-8ED3-27250A1EDEC8}
EventID 141
Version 0
Level 4
Task 4
Opcode 11
Keywords 0x4000000000000000
- TimeCreated
[ SystemTime] 2019-08-21T16:18:58.524806700Z
EventRecordID 1163
- Correlation
[ ActivityID] {F42025B4-701E-4D3A-868E-96285FB50000}
- Execution
[ ProcessID] 576
[ ThreadID] 368
Channel Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational
Computer
- Security
[ UserID] S-1-5-20
- EventData
InstanceID 0
====================================================================================================================
Event 226, RemoteDesktopService-RdpsCoreTS
RDP_TCP: An error was encountered when transitioning from StatePreparingX224CC in response to Event_ERROR_SendingX224CC (error code 0x0).
[ Name] Microsoft-Windows-RemoteDesktopServices-RdpCoreTS
[ Guid] {1139C61B-B549-4251-8ED3-27250A1EDEC8}
EventID 226
Version 0
Level 3
Task 4
Opcode 19
Keywords 0x4000000000000000
- TimeCreated
[ SystemTime] 2019-08-21T16:18:58.526330700Z
EventRecordID 1164
- Correlation
[ ActivityID] {F42025B4-701E-4D3A-868E-96285FB50000}
- Execution
[ ProcessID] 576
[ ThreadID] 2056
Channel Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational
Computer
- Security
[ UserID] S-1-5-20
- EventData
StateTransition RDP_TCP
PreviousState 1
PreviousStateName StatePreparingX224CC
NewState 22
NewStateName StateError
Event 29
EventName Event_ERROR_SendingX224CC
ErrorCode 0x0
====================================================================================================================
Event 72, RemoteDesktopService-RdpsCoreTS
General
Interface method called: OnDisconnected(server initiated)
[ Name] Microsoft-Windows-RemoteDesktopServices-RdpCoreTS
[ Guid] {1139C61B-B549-4251-8ED3-27250A1EDEC8}
EventID 72
Version 0
Level 4
Task 4
Opcode 13
Keywords 0x4000000000000000
- TimeCreated
[ SystemTime] 2019-08-21T16:18:58.526574600Z
EventRecordID 1165
- Correlation
[ ActivityID] {F42025B4-701E-4D3A-868E-96285FB50000}
- Execution
[ ProcessID] 576
[ ThreadID] 1784
Channel Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational
Computer
- Security
[ UserID] S-1-5-20
- EventData
MethodName OnDisconnected(server initiated)
====================================================================================================================
Event 227, RemoteDesktopService-RdpsCoreTS
'Failed to get property Disconnect Reason' in CUMRDPConnection::Close at 2212 err=[0x80070057]
[ Name] Microsoft-Windows-RemoteDesktopServices-RdpCoreTS
[ Guid] {1139C61B-B549-4251-8ED3-27250A1EDEC8}
EventID 227
Version 0
Level 2
Task 4
Opcode 19
Keywords 0x4000000000000000
- TimeCreated
[ SystemTime] 2019-08-21T16:18:58.526634500Z
EventRecordID 1166
- Correlation
[ ActivityID] {F42025B4-701E-4D3A-868E-96285FB50000}
- Execution
[ ProcessID] 576
[ ThreadID] 368
Channel Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational
Computer
- Security
[ UserID] S-1-5-20
- EventData
Name CUMRDPConnection
Value 2147942487
CustomLevel 'Failed to get property Disconnect Reason' in CUMRDPConnection::Close at 2212 err=[0x80070057]
====================================================================================================================
Event 103, RemoteDesktopService-RdpsCoreTS
General
The disconnect reason is 0
[ Name] Microsoft-Windows-RemoteDesktopServices-RdpCoreTS
[ Guid] {1139C61B-B549-4251-8ED3-27250A1EDEC8}
EventID 103
Version 0
Level 4
Task 4
Opcode 17
Keywords 0x4000000000000000
- TimeCreated
[ SystemTime] 2019-08-21T16:18:58.526636800Z
EventRecordID 1167
- Correlation
[ ActivityID] {F42025B4-701E-4D3A-868E-96285FB50000}
- Execution
[ ProcessID] 576
[ ThreadID] 368
Channel Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational
Computer
- Security
[ UserID] S-1-5-20
- EventData
ReasonCode 0
====================================================================================================================
Event 102, RemoteDesktopService-RdpsCoreTS
General
The server has terminated main RDP connection with the client.
[ Name] Microsoft-Windows-RemoteDesktopServices-RdpCoreTS
[ Guid] {1139C61B-B549-4251-8ED3-27250A1EDEC8}
EventID 102
Version 0
Level 4
Task 4
Opcode 17
Keywords 0x4000000000000000
- TimeCreated
[ SystemTime] 2019-08-21T16:18:58.526972300Z
EventRecordID 1168
- Correlation
[ ActivityID] {F42025B4-701E-4D3A-868E-96285FB50000}
- Execution
[ ProcessID] 576
[ ThreadID] 1784
Channel Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational
Computer
- Security
[ UserID] S-1-5-20
EventData
====================================================================================================================
Event 145, RemoteDesktopService-RdpsCoreTS
General
During this connection, server has not sent data or graphics update for 0 seconds (Idle1: 0, Idle2: 0).
[ Name] Microsoft-Windows-RemoteDesktopServices-RdpCoreTS
[ Guid] {1139C61B-B549-4251-8ED3-27250A1EDEC8}
EventID 145
Version 0
Level 4
Task 4
Opcode 19
Keywords 0x4000000000000000
- TimeCreated
[ SystemTime] 2019-08-21T16:18:58.526978200Z
EventRecordID 1169
- Correlation
[ ActivityID] {F42025B4-701E-4D3A-868E-96285FB50000}
- Execution
[ ProcessID] 576
[ ThreadID] 1784
Channel Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational
Computer
- Security
[ UserID] S-1-5-20
- EventData
IdleSeconds 0
IdleSeconds1 0
IdleSeconds2 0
====================================================================================================================
Event 148, RemoteDesktopService-RdpsCoreTS
General
Channel rdpinpt has been closed between the server and the client on transport tunnel: 0.
[ Name] Microsoft-Windows-RemoteDesktopServices-RdpCoreTS
[ Guid] {1139C61B-B549-4251-8ED3-27250A1EDEC8}
EventID 148
Version 0
Level 4
Task 4
Opcode 17
Keywords 0x4000000000000000
- TimeCreated
[ SystemTime] 2019-08-21T16:18:58.526983100Z
EventRecordID 1170
- Correlation
[ ActivityID] {F42025B4-701E-4D3A-868E-96285FB50000}
- Execution
[ ProcessID] 576
[ ThreadID] 1784
Channel Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational
Computer
- Security
[ UserID] S-1-5-20
- EventData
ChannelName rdpinpt
TunnelID 0
===================================================================================================================
Event 148, RemoteDesktopService-RdpsCoreTS
General
Channel rdpcmd has been closed between the server and the client on transport tunnel: 0.
[ Name] Microsoft-Windows-RemoteDesktopServices-RdpCoreTS
[ Guid] {1139C61B-B549-4251-8ED3-27250A1EDEC8}
EventID 148
Version 0
Level 4
Task 4
Opcode 17
Keywords 0x4000000000000000
- TimeCreated
[ SystemTime] 2019-08-21T16:18:58.526986700Z
EventRecordID 1171
- Correlation
[ ActivityID] {F42025B4-701E-4D3A-868E-96285FB50000}
- Execution
[ ProcessID] 576
[ ThreadID] 1784
Channel Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational
Computer
- Security
[ UserID] S-1-5-20
- EventData
ChannelName rdpcmd
TunnelID 0
====================================================================================================================
Event 148, RemoteDesktopService-RdpsCoreTS
Channel rdplic has been closed between the server and the client on transport tunnel: 0.
[ Name] Microsoft-Windows-RemoteDesktopServices-RdpCoreTS
[ Guid] {1139C61B-B549-4251-8ED3-27250A1EDEC8}
EventID 148
Version 0
Level 4
Task 4
Opcode 17
Keywords 0x4000000000000000
- TimeCreated
[ SystemTime] 2019-08-21T16:18:58.526989600Z
EventRecordID 1172
- Correlation
[ ActivityID] {F42025B4-701E-4D3A-868E-96285FB50000}
- Execution
[ ProcessID] 576
[ ThreadID] 1784
Channel Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational
Computer
- Security
[ UserID] S-1-5-20
- EventData
ChannelName rdplic
TunnelID 0
Look forward to hearing from the community, and solving this problem.
Continue reading...
I am provisioning a a Windows 10 Enterprise workstation for my company it is a clean install of the OS. The version of windows that is installed is build 10.0.14393.3053. I have the device connected to our network here which is private. Since the first time that I put the device on to the network I have been unable to RDP into it via a Windows 7 Pro workstation that I use for work. Both devices are part of the same domain, I am able to remote from the Windows 10 workstation to the Windows 7 workstation but not the other way around. I have followed several suggestions from MS and also from technet forums with no success. Remote setting are set to allow remote connections and to use NLA. I am unable to access the advanced options for the remote settings because it is grayed out. I also, do not have the option to enable remote access setting as it is also grayed out. The RemoteDesktopServices as well as the Remote Desktop Services Usermode Redirector are both running and set to automatic. The workstation has been patched with all updates available to this build. I have viewed the event logs under EventViewer>Applications and Services log>Microsoft>Windows>RemoteDesktopServices>RdpCoreTs/Operational and it appears that the workstations attempt to connect but the connection is dropped almost immediately. I have been troubleshooting it for a few days now and I have gotten nowhere it seems. I have included the information that I collected from Event Viewer from the time the connection is established to the time it is disconnected from the client. I have removed the name of the workstation for security purposes.
These are the entries that I see in EventViewer>Applications and Services log>Microsoft>Windows>RemoteDesktopServices>RdpCoreTs/Operational
Information
Event 131, RemoteDesktopServices-RdpsCoreTS
General
The server accepted a new TCP connection from client 172.20.27.118:57276.
[ Name] Microsoft-Windows-RemoteDesktopServices-RdpCoreTS
[ Guid] {1139C61B-B549-4251-8ED3-27250A1EDEC8}
EventID 131
Version 0
Level 4
Task 4
Opcode 15
Keywords 0x4000000000000000
- TimeCreated
[ SystemTime] 2019-08-21T16:18:58.517269000Z
EventRecordID 1159
- Correlation
[ ActivityID] {F42025B4-701E-4D3A-868E-96285FB50000}
- Execution
[ ProcessID] 576
[ ThreadID] 1796
Channel Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational
Computer
- Security
[ UserID] S-1-5-20
- EventData
ConnType TCP
ClientIP 172.20.27.118:57276
==============================================================================================================
Event 65, RemoteDesktopService-RdpsCoreTS
General
Connection RDP-Tcp#0 created
[ Name] Microsoft-Windows-RemoteDesktopServices-RdpCoreTS
[ Guid] {1139C61B-B549-4251-8ED3-27250A1EDEC8}
EventID 65
Version 0
Level 4
Task 4
Opcode 13
Keywords 0x4000000000000000
- TimeCreated
[ SystemTime] 2019-08-21T16:18:58.519989200Z
EventRecordID 1160
- Correlation
[ ActivityID] {F42025B4-701E-4D3A-868E-96285FB50000}
- Execution
[ ProcessID] 576
[ ThreadID] 1792
Channel Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational
Computer
- Security
[ UserID] S-1-5-20
- EventData
ConnectionName RDP-Tcp#0
====================================================================================================================
Event 72, RemoteDesktopService-RdpsCoreTS
General
Interface method called: PrepareForAccept
[ Name] Microsoft-Windows-RemoteDesktopServices-RdpCoreTS
[ Guid] {1139C61B-B549-4251-8ED3-27250A1EDEC8}
EventID 72
Version 0
Level 4
Task 4
Opcode 13
Keywords 0x4000000000000000
- TimeCreated
[ SystemTime] 2019-08-21T16:18:58.522375300Z
EventRecordID 1161
- Correlation
[ ActivityID] {F42025B4-701E-4D3A-868E-96285FB50000}
- Execution
[ ProcessID] 576
[ ThreadID] 368
Channel Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational
Computer
- Security
[ UserID] S-1-5-20
- EventData
MethodName PrepareForAccept
====================================================================================================================
Event 72, RemoteDesktopService-RdpsCoreTS
General
Interface method called: SendPolicyData
Name] Microsoft-Windows-RemoteDesktopServices-RdpCoreTS
[ Guid] {1139C61B-B549-4251-8ED3-27250A1EDEC8}
EventID 72
Version 0
Level 4
Task 4
Opcode 13
Keywords 0x4000000000000000
- TimeCreated
[ SystemTime] 2019-08-21T16:18:58.522390200Z
EventRecordID 1162
- Correlation
[ ActivityID] {F42025B4-701E-4D3A-868E-96285FB50000}
- Execution
[ ProcessID] 576
[ ThreadID] 368
Channel Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational
Computer
- Security
[ UserID] S-1-5-20
- EventData
MethodName SendPolicyData
====================================================================================================================
Event 141, RemoteDesktopService-RdpsCoreTS
General
PerfCounter session started with instance ID 0
[ Name] Microsoft-Windows-RemoteDesktopServices-RdpCoreTS
[ Guid] {1139C61B-B549-4251-8ED3-27250A1EDEC8}
EventID 141
Version 0
Level 4
Task 4
Opcode 11
Keywords 0x4000000000000000
- TimeCreated
[ SystemTime] 2019-08-21T16:18:58.524806700Z
EventRecordID 1163
- Correlation
[ ActivityID] {F42025B4-701E-4D3A-868E-96285FB50000}
- Execution
[ ProcessID] 576
[ ThreadID] 368
Channel Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational
Computer
- Security
[ UserID] S-1-5-20
- EventData
InstanceID 0
====================================================================================================================
Event 226, RemoteDesktopService-RdpsCoreTS
RDP_TCP: An error was encountered when transitioning from StatePreparingX224CC in response to Event_ERROR_SendingX224CC (error code 0x0).
[ Name] Microsoft-Windows-RemoteDesktopServices-RdpCoreTS
[ Guid] {1139C61B-B549-4251-8ED3-27250A1EDEC8}
EventID 226
Version 0
Level 3
Task 4
Opcode 19
Keywords 0x4000000000000000
- TimeCreated
[ SystemTime] 2019-08-21T16:18:58.526330700Z
EventRecordID 1164
- Correlation
[ ActivityID] {F42025B4-701E-4D3A-868E-96285FB50000}
- Execution
[ ProcessID] 576
[ ThreadID] 2056
Channel Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational
Computer
- Security
[ UserID] S-1-5-20
- EventData
StateTransition RDP_TCP
PreviousState 1
PreviousStateName StatePreparingX224CC
NewState 22
NewStateName StateError
Event 29
EventName Event_ERROR_SendingX224CC
ErrorCode 0x0
====================================================================================================================
Event 72, RemoteDesktopService-RdpsCoreTS
General
Interface method called: OnDisconnected(server initiated)
[ Name] Microsoft-Windows-RemoteDesktopServices-RdpCoreTS
[ Guid] {1139C61B-B549-4251-8ED3-27250A1EDEC8}
EventID 72
Version 0
Level 4
Task 4
Opcode 13
Keywords 0x4000000000000000
- TimeCreated
[ SystemTime] 2019-08-21T16:18:58.526574600Z
EventRecordID 1165
- Correlation
[ ActivityID] {F42025B4-701E-4D3A-868E-96285FB50000}
- Execution
[ ProcessID] 576
[ ThreadID] 1784
Channel Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational
Computer
- Security
[ UserID] S-1-5-20
- EventData
MethodName OnDisconnected(server initiated)
====================================================================================================================
Event 227, RemoteDesktopService-RdpsCoreTS
'Failed to get property Disconnect Reason' in CUMRDPConnection::Close at 2212 err=[0x80070057]
[ Name] Microsoft-Windows-RemoteDesktopServices-RdpCoreTS
[ Guid] {1139C61B-B549-4251-8ED3-27250A1EDEC8}
EventID 227
Version 0
Level 2
Task 4
Opcode 19
Keywords 0x4000000000000000
- TimeCreated
[ SystemTime] 2019-08-21T16:18:58.526634500Z
EventRecordID 1166
- Correlation
[ ActivityID] {F42025B4-701E-4D3A-868E-96285FB50000}
- Execution
[ ProcessID] 576
[ ThreadID] 368
Channel Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational
Computer
- Security
[ UserID] S-1-5-20
- EventData
Name CUMRDPConnection
Value 2147942487
CustomLevel 'Failed to get property Disconnect Reason' in CUMRDPConnection::Close at 2212 err=[0x80070057]
====================================================================================================================
Event 103, RemoteDesktopService-RdpsCoreTS
General
The disconnect reason is 0
[ Name] Microsoft-Windows-RemoteDesktopServices-RdpCoreTS
[ Guid] {1139C61B-B549-4251-8ED3-27250A1EDEC8}
EventID 103
Version 0
Level 4
Task 4
Opcode 17
Keywords 0x4000000000000000
- TimeCreated
[ SystemTime] 2019-08-21T16:18:58.526636800Z
EventRecordID 1167
- Correlation
[ ActivityID] {F42025B4-701E-4D3A-868E-96285FB50000}
- Execution
[ ProcessID] 576
[ ThreadID] 368
Channel Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational
Computer
- Security
[ UserID] S-1-5-20
- EventData
ReasonCode 0
====================================================================================================================
Event 102, RemoteDesktopService-RdpsCoreTS
General
The server has terminated main RDP connection with the client.
[ Name] Microsoft-Windows-RemoteDesktopServices-RdpCoreTS
[ Guid] {1139C61B-B549-4251-8ED3-27250A1EDEC8}
EventID 102
Version 0
Level 4
Task 4
Opcode 17
Keywords 0x4000000000000000
- TimeCreated
[ SystemTime] 2019-08-21T16:18:58.526972300Z
EventRecordID 1168
- Correlation
[ ActivityID] {F42025B4-701E-4D3A-868E-96285FB50000}
- Execution
[ ProcessID] 576
[ ThreadID] 1784
Channel Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational
Computer
- Security
[ UserID] S-1-5-20
EventData
====================================================================================================================
Event 145, RemoteDesktopService-RdpsCoreTS
General
During this connection, server has not sent data or graphics update for 0 seconds (Idle1: 0, Idle2: 0).
[ Name] Microsoft-Windows-RemoteDesktopServices-RdpCoreTS
[ Guid] {1139C61B-B549-4251-8ED3-27250A1EDEC8}
EventID 145
Version 0
Level 4
Task 4
Opcode 19
Keywords 0x4000000000000000
- TimeCreated
[ SystemTime] 2019-08-21T16:18:58.526978200Z
EventRecordID 1169
- Correlation
[ ActivityID] {F42025B4-701E-4D3A-868E-96285FB50000}
- Execution
[ ProcessID] 576
[ ThreadID] 1784
Channel Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational
Computer
- Security
[ UserID] S-1-5-20
- EventData
IdleSeconds 0
IdleSeconds1 0
IdleSeconds2 0
====================================================================================================================
Event 148, RemoteDesktopService-RdpsCoreTS
General
Channel rdpinpt has been closed between the server and the client on transport tunnel: 0.
[ Name] Microsoft-Windows-RemoteDesktopServices-RdpCoreTS
[ Guid] {1139C61B-B549-4251-8ED3-27250A1EDEC8}
EventID 148
Version 0
Level 4
Task 4
Opcode 17
Keywords 0x4000000000000000
- TimeCreated
[ SystemTime] 2019-08-21T16:18:58.526983100Z
EventRecordID 1170
- Correlation
[ ActivityID] {F42025B4-701E-4D3A-868E-96285FB50000}
- Execution
[ ProcessID] 576
[ ThreadID] 1784
Channel Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational
Computer
- Security
[ UserID] S-1-5-20
- EventData
ChannelName rdpinpt
TunnelID 0
===================================================================================================================
Event 148, RemoteDesktopService-RdpsCoreTS
General
Channel rdpcmd has been closed between the server and the client on transport tunnel: 0.
[ Name] Microsoft-Windows-RemoteDesktopServices-RdpCoreTS
[ Guid] {1139C61B-B549-4251-8ED3-27250A1EDEC8}
EventID 148
Version 0
Level 4
Task 4
Opcode 17
Keywords 0x4000000000000000
- TimeCreated
[ SystemTime] 2019-08-21T16:18:58.526986700Z
EventRecordID 1171
- Correlation
[ ActivityID] {F42025B4-701E-4D3A-868E-96285FB50000}
- Execution
[ ProcessID] 576
[ ThreadID] 1784
Channel Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational
Computer
- Security
[ UserID] S-1-5-20
- EventData
ChannelName rdpcmd
TunnelID 0
====================================================================================================================
Event 148, RemoteDesktopService-RdpsCoreTS
Channel rdplic has been closed between the server and the client on transport tunnel: 0.
[ Name] Microsoft-Windows-RemoteDesktopServices-RdpCoreTS
[ Guid] {1139C61B-B549-4251-8ED3-27250A1EDEC8}
EventID 148
Version 0
Level 4
Task 4
Opcode 17
Keywords 0x4000000000000000
- TimeCreated
[ SystemTime] 2019-08-21T16:18:58.526989600Z
EventRecordID 1172
- Correlation
[ ActivityID] {F42025B4-701E-4D3A-868E-96285FB50000}
- Execution
[ ProcessID] 576
[ ThreadID] 1784
Channel Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational
Computer
- Security
[ UserID] S-1-5-20
- EventData
ChannelName rdplic
TunnelID 0
Look forward to hearing from the community, and solving this problem.
Continue reading...