Код ошибки 56 termdd

Не удается подключится к компьютеру с Windows 7 Профессиональная с использованием RDP. Выдается ошибка «Не удается подключится к удаленному компьютеру». на удаленном компьютере удаленный доступ разрешен. Переключатель в настройках стоит на опции «Разрешать подключения от компьютеров с любой версией удаленного рабочего стола (опаснее)». Брандмауэр отключен (с включенным и разрешающим все подключения ситуация аналогичная). В журнале удаленного компьютера при попытке подключения генерируется событие:
Источник: TermDD
Код события: 56
Уровень безопасности сервера терминалов обнаружил ошибку в потоке протокола и отключил этот клиент. IP-адрес клиента:XXX.XXX.XXX.XXX.
Профиль пользователя не перемещаемый.
Драйвер сетевой карты самый свежий (пробовал и с более старой версией).
Пробовал менять тип шифрования в дополнительных параметрах общего доступа для различных сетевых профилей.
Подключение с Server 2003 проходит, но с Server 2008, Windows 7 и др. нет.
Поиск в google возможных причин и решений результата не дал.
Буду рад любой помощи в решении проблемы.

• 
  Вопрос задан

  более трёх лет назад
  

• 6796 просмотров

First published on TECHNET on Mar 24, 2010

Hi folks! It’s been a long time since I wrote the

Terminal Services and Graphically Intensive Applications

post. Today’s post is a short one; we will be discussing a curious case of Event ID: 56 on Windows Server 2008/R2 with the Remote Desktop Services Role. The clients were being disconnected by the server and the following error was generated:

Log Name:      System

Source:        TermDD

Event ID:      56

Level:         Error

Description:

The Terminal Server security layer detected an error in the protocol stream and has disconnected the client.

Event Xml:

<Event xmlns=»

http://schemas.microsoft.com/win/2004/08/events/event»

>

<System>

<Provider Name=»TermDD» />

<EventID Qualifiers=»49162″>56</EventID>

<Level>2</Level>

<Task>0</Task>

<Keywords>0x80000000000000</Keywords>

<TimeCreated SystemTime=»» />

<EventRecordID></EventRecordID>

<Channel>System</Channel>

<Computer> </Computer>

<Security />

</System>

<EventData>

<Data>DeviceTermdd</Data>

<Data></Data> <Binary>00000400010000000000000038000AC00000000038000AC000000000000000000000000000000000840100D0</Binary>

</EventData>

</Event>

This happened in conditions of heavy traffic to the server along with large client packets (i.e. lot of input activity on the client). As a result, the data stream gets corrupted and the TS server disconnects the client.

To track this down, I looked at the binary data attached to the event. The last DWORD is the error code is converted to an HRESULT.

For example if you have the following binary data attached to the event…

<Binary>


00000400010000000000000038000AC00000000038000AC000000000000000000000000000000000

840100D0



</Binary>

…we first take the last 4 bytes:

840100D0

.

You first have to reverse the byte order to get a readable error code. You don’t reverse the whole thing, you reverse each byte pair individually. So,

D0

moves to the front, followed by

00

etc. After reversing you’ll get this:

D0000184.

To make it even messier, the

D

is actually a result of converting an NTSTATUS code into HRESULT, so we then have to replace it with

C

(Normally HRESULT would start with “8”). Thus, you need to replace “D” with “C”.

Finally we now have and NTSTATUS error of

C0000184.

You can look up this error code using something like Err.exe and and get


STATUS_INVALID_DEVICE_STATE


.

This most likely indicates that server was trying to send data to the client after the connection was broken. It does not tell us why the connection was broken. Additional codes might be more informative:

C00000B5



— STATUS_IO_TIMEOUT — the connection has timed out.

C000006F



— STATUS_INVALID_LOGON_HOURS — The user account has time restrictions and may not be logged onto at this time.

80090330



— SEC_E_DECRYPT_FAILURE – the data on the wire got corrupted

To decipher the codes, you can download Err.exe from:

http://www.microsoft.com/downloads/details.aspx?familyid=be596899-7bb8-4208-b7fc-09e02a13696c&d…

113996 INFO: Mapping NT Status Error Codes to Win32 Error Codes

http://support.microsoft.com/default.aspx?scid=kb;EN-US;113996

Another way to troubleshoot the error is more inclined towards the driver development community, which is to use Windows Software Trace Preprocessor (WPP) to trace a driver’s operation; it enhances

WMI event tracing

by adding conventions and mechanisms that simplify tracing a driver’s operation. It is an efficient mechanism for user-mode applications and kernel-mode drivers to log real-time binary messages. The logged messages can subsequently be converted to a human-readable trace of the driver’s operation.

http://msdn.microsoft.com/en-us/library/ms793164.aspx

For the protocol details, message syntax and code references you can review:

[MS-RDPBCGR]: Remote Desktop Protocol: Basic Connectivity and Graphics Remoting Specification

http://msdn.microsoft.com/en-us/library/cc240445(PROT.10).aspx

or in PDF format:

http://download.microsoft.com/download/9/5/E/95EF66AF-9026-4BB0-A41D-A4F81802D92C/%5BMS-RDPBCGR…

That’s all for now…Until next time, take care and happy reading!

Subheet Rastogi

Share this post :

<br/>

Load More