Message

%1

Fields

Message

%1

Fields

Message

%1

Fields

Message

%1

Fields

Message

%1

Fields

Message

%1

Fields

Message

%1

Fields

Message

%1

Fields

Message

Remote Desktop Services Remote Connection Manager is starting up

Message

Remote Desktop Services Remote Connection Manager has finished start up. Return code %1

Fields

Message

Listener %1 has started listening

Fields

Example Event

system:
  provider: Microsoft-Windows-TerminalServices-RemoteConnectionManager
  guid: C76BAA63-AE81-421C-B425-340B4B24157F
  event_source_name: ''
  event_id: 258
  version: 0
  level: 4
  task: 0
  opcode: 0
  keywords: 1152921504606846976
  time_created: '2019-02-13T17:18:30.771694+00:00'
  event_record_id: 221
  correlation:
    ActivityID: 00000000-0244-0000-C48E-2E890BC4D401
  execution:
    process_id: 1280
    thread_id: 1548
  channel: Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational
  computer: PC01.example.corp
  security:
    user_id: S-1-5-20
user_data:
  EventXML:
    xmlns:auto-ns2: http://schemas.microsoft.com/win/2004/08/events
    listenerName: RDP-Tcp
message: Listener http://schemas.microsoft.com/win/2004/08/events has started listening

References

• Example event sourced from https://github.com/Yamato-Security/hayabusa-sample-evtx

Message

Listener %1 has stopped listening

Fields

Message

Listener %1 failed while listening. Error code %2

Fields

Message

Listener %1 received a connection

Fields

Example Event

system:
  provider: Microsoft-Windows-TerminalServices-RemoteConnectionManager
  guid: C76BAA63-AE81-421C-B425-340B4B24157F
  event_source_name: ''
  event_id: 261
  version: 0
  level: 4
  task: 0
  opcode: 0
  keywords: 1152921504606846976
  time_created: '2019-02-13T18:04:45.905782+00:00'
  event_record_id: 227
  correlation: {}
  execution:
    process_id: 1280
    thread_id: 1876
  channel: Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational
  computer: PC01.example.corp
  security:
    user_id: S-1-5-20
user_data:
  EventXML:
    xmlns:auto-ns2: http://schemas.microsoft.com/win/2004/08/events
    listenerName: RDP-Tcp
message: Listener http://schemas.microsoft.com/win/2004/08/events received a connection

References

• Example event sourced from https://github.com/Yamato-Security/hayabusa-sample-evtx

Message

Listener %1 has been asked to stop listening

Fields

Message

WDDM graphics mode is enabled

Message

Connection with ID %1 has started

Fields

Message

Connection with ID %1 for session %2 has completed, total time %3 (ms), stack time %4 (ms)

Fields

Message

Reconnect connection ID %1 to session %2 took %3 (ms)

Fields

Message

The remote desktop client '%1' has provided an invalid license.

Fields

Message

The Remote Desktop Session Host server cannot issue a client license.  It was unable to issue the license due to a changed (mismatched) client license, insufficient memory, or an internal error. Further details for this problem may have been reported at the client's computer.

Message

The RD Session Host server received large number of incomplete connections.  The system may be under attack.

Message

The remote session could not be established from remote desktop client %1 because its temporary license has expired.

Fields

Example Event

system:
  provider: Microsoft-Windows-TerminalServices-RemoteConnectionManager
  guid: '{C76BAA63-AE81-421C-B425-340B4B24157F}'
  event_source_name: TermService
  event_id: 1056
  version: 0
  level: 4
  task: 0
  opcode: 0
  keywords: 36028797018963968
  time_created: '2013-10-23T21:47:52.000000Z'
  event_record_id: 2660
  correlation: {}
  execution:
    process_id: 0
    thread_id: 0
  channel: System
  computer: IE8Win7
  security:
    user_id: ''
event_data: {}

References

• Example event sourced from https://github.com/NextronSystems/evtx-baseline

Message

The RD Licensing mode has not been configured.

Message

The RD Licensing grace period has expired and Licensing mode for the Remote Desktop Session Host server has not been configured. Licensing mode must be configured for continuous operation.

Message

RD Session Host Server role is not installed.

Example Event

system:
  provider: Microsoft-Windows-TerminalServices-RemoteConnectionManager
  guid: C76BAA63-AE81-421C-B425-340B4B24157F
  event_source_name: ''
  event_id: 1136
  version: 0
  level: 4
  task: 0
  opcode: 0
  keywords: 1152921504606846976
  time_created: '2019-02-13T17:18:41.657347+00:00'
  event_record_id: 222
  correlation: {}
  execution:
    process_id: 1008
    thread_id: 2440
  channel: Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational
  computer: PC01.example.corp
  security:
    user_id: S-1-5-18
event_data: {}
message: RD Session Host Server role is not installed.

References

• Example event sourced from https://github.com/Yamato-Security/hayabusa-sample-evtx

Message

The roaming user profile cache manager for Remote Desktop Services could not start. Error Code: %1

Fields

Message

The roaming user profile cache manager for Remote Desktop Services could not start because an incorrect value was specified for the monitoring interval. Error Code: %1

Fields

Message

The roaming user profile cache manager for Remote Desktop Services could not start because an incorrect value was specified for the maximum cache size. Error Code: %1

Fields

Message

The "Limit the size of the entire roaming user profile cache" Group Policy setting has been enabled, but the roaming user profile cache manager for Remote Desktop Services has encountered a problem. Error Code: %1

Fields

Message

The "Limit the size of the entire roaming user profile cache" Group Policy setting has been disabled, but the roaming user profile cache manager for Remote Desktop Services has encountered a problem. Error Code: %1

Fields

Message

The "Limit the size of the entire roaming user profile cache" Group Policy setting has been enabled.

Message

The "Limit the size of the entire roaming user profile cache" Group Policy setting has been disabled.

Message

The roaming user profile cache manager for Remote Desktop Services could not delete the roaming user profile for the user %1. The roaming user profile cache might still exceed the %2 gigabyte limit. Error Code: %3

Fields

Message

The roaming user profile cache manager for Remote Desktop Services deleted the roaming user profile for the user %1 because the roaming user profile cache exceeded the %2 gigabyte limit.

Fields

Message

Remote Desktop Services: Remote control session initiated:

%1 initiated a remote control session:
User: %2
Domain: %3

Fields

Message

Remote Desktop Services: Remote control session connection succeeded:

%1 initiated a remote control session:
User: %2
Domain: %3

Fields

Message

Remote Desktop Services: Remote control session connection failed:

%1 initiated a remote control session:
User: %2
Domain: %3

Fields

Message

Remote Desktop Services: User authentication succeeded:

User: %1
Domain: %2
Source Network Address: %3

Fields

Example Event

system:
  provider: Microsoft-Windows-TerminalServices-RemoteConnectionManager
  guid: C76BAA63-AE81-421C-B425-340B4B24157F
  event_source_name: ''
  event_id: 1149
  version: 0
  level: 4
  task: 0
  opcode: 0
  keywords: 1152921504606846976
  time_created: '2019-02-13T18:04:57.452387+00:00'
  event_record_id: 228
  correlation: {}
  execution:
    process_id: 1280
    thread_id: 2748
  channel: Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational
  computer: PC01.example.corp
  security:
    user_id: S-1-5-20
user_data:
  EventXML:
    xmlns:auto-ns2: http://schemas.microsoft.com/win/2004/08/events
    Param1: admin01
    Param2: example
    Param3: 127.0.0.1
message: 'Remote Desktop Services: User authentication succeeded:


  User: http://schemas.microsoft.com/win/2004/08/events

  Domain: admin01

  Source Network Address: example'

Community Notes

References

• Example event sourced from https://github.com/Yamato-Security/hayabusa-sample-evtx

Message

Remote Desktop Services: User config data have been merged:

User: %1
Domain: %2
Source Network Address: %3

Fields

Message

The remote user's connection was declined by the logged on user.

User Account: %2
Domain: %1
Source IP Address: %3

Fields

Message

Failed to create KVP sessions string. Error Code %1

Fields

Message

Failed to write KVP sessions string. Error Code %1

Fields

Message

Failed to open KVP registry key. Error Code {Param1}

Fields

Message

The Remote Connection Manager selected Kernel mode RDP protocol stack.

Example Event

system:
  provider: Microsoft-Windows-TerminalServices-RemoteConnectionManager
  guid: C76BAA63-AE81-421C-B425-340B4B24157F
  event_source_name: ''
  event_id: 1155
  version: 0
  level: 4
  task: 0
  opcode: 0
  keywords: 1152921504606846976
  time_created: '2019-02-13T17:18:28.040385+00:00'
  event_record_id: 220
  correlation:
    ActivityID: 8F0C0C22-A5AA-4F83-B10F-0880AB96471F
  execution:
    process_id: 1280
    thread_id: 1548
  channel: Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational
  computer: PC01.example.corp
  security:
    user_id: S-1-5-20
event_data: {}
message: The Remote Connection Manager selected Kernel mode RDP protocol stack.

References

• Example event sourced from https://github.com/Yamato-Security/hayabusa-sample-evtx

Message

The Remote Connection Manager selected User mode RDP protocol stack.

Message

The listener named %1 has modified some configuration settings.

Fields

Message

Remote Desktop Services accepted a connection from IP address %1.

Fields

Message

Remote Desktop Configuration service could not remove user %1\%2 from administrators group, error Code: %3

Fields

Message

Remote Desktop Configuration service could not remove user %1\%2 from Remote Desktop Users group, error Code: %3

Fields

Message

Remote Desktop Configuration service could not remove user with SID %1 from administrators group, error Code: %2

Fields

Message

Remote Desktop Configuration service could not remove user with SID %1 from Remote Desktop Users group, error Code: %2

Fields

Message

Remote Desktop Configuration service has added user %1\%2 to administrators group

Fields

Message

Remote Desktop Configuration service has added user %1\%2 to Remote Desktop Users group

Fields

Message

Remote Desktop Configuration service has removed user with SID %1 from administrators group

Fields

Message

Remote Desktop Configuration service has removed user with SID %1 from Remote Desktop Users group

Fields

Message

Remote Desktop Configuration service has removed user %1\%2 from administrators group

Fields

Message

Remote Desktop Configuration service has removed user %1\%2 from Remote Desktop Users group

Fields

Fields

Fields

Fields

Fields

Message

Remote Desktop Services Network Fair Share started.

Message

Remote Desktop Services Network Fair Share stopped.

Message

Remote Desktop Services Network Fair Share was enabled for the user account %1 with a weight of %2.

Fields

Message

Remote Desktop Service Network Fairshare has been enabled for connection on session %1 with weight of %2.

Fields

Message

Remote Desktop Services could not enable Network Fair Share for the user account %1. The error code is %2.

Fields

Message

Remote Desktop Services could not enable Network Fair Share for the connection on session %1. The error code is %2.

Fields

Message

Remote Desktop Services could not enable Network Fair Share for session %1. The error code is %2.

Fields

Message

Remote Desktop Services Network Fair Share was disabled for the user account %1.

Fields

Message

Remote Desktop Services Network Fair Share was disabled for the connection on session %1.

Fields

Message

Remote Desktop Services could not disable Network Fair Share for the user account %1. The error code is %2.

Fields

Message

Remote Desktop Services could not disable Network Fair Share for the connection on session %1. The error code is %2.

Fields

Message

Remote Desktop Services could not disconnect a user disk for the user account with a SID of %1. The error code is %2.%3

Fields

Message

Remote Desktop Services could not detach a user disk for the user account with a SID of %1. The error code is %2.%3

Fields

Message

Remote Desktop Services could not apply a user desktop for a user account with a SID of %1. A temporary profile was enforced for the user. Verify that the user profile disk settings are correct. The error code is %2.%3

Fields

Message

Remote Desktop Services could not obtain a user profile disk for the user account with a SID of %1. Verify that the user profile disk location is accessible, the server's computer account has read and write permissions to it, and that the location has a user profile disk template file present. The error code is %2.%3

Fields

Message

Remote Desktop Services could not attach a user profile disk for a user account with a SID of %1. The error code is %2.%3

Fields

Message

Remote Desktop Services could not apply a user desktop for a user account with a SID of %1. A temporary profile could not be enforced for the user. The user will get a normal profile, and the user's state will be discarded when the user logs off. Verify that the user profile disk settings are correct. The error code is %2.%3

Fields

Message

The RD Licensing has taken too long to process the client license

Message

Remote Desktop Services has taken too long to complete the client connection

Message

Remote Desktop Services has taken too long to load the user configuration from server %1 for user %2

Fields

Message

Remote Desktop Services took %3 milliseconds to load the user configuration from server %1 for user %2

Fields

Message

Remote Desktop Services failed to shutdown within the time allocated

Message

Remote Desktop Services failed to retrieve information about a connection for session %1 within the time allocated

Fields

Message

Shadow View Session Started

User %1 on computer %2 viewing user %3 (Session ID: %4)

Fields

Message

Shadow View Session Stopped

User %1 on computer %2 viewing user %3 (Session ID: %4)

Fields

Message

Shadow Control Session Started

User %1 on computer %2 controlling user %3 (Session ID: %4)

Fields

Message

Shadow Control Session Stopped

User %1 on computer %2 controlling user %3 (Session ID: %4)

Fields

Message

Shadow View Permission Granted

User %1 (Session ID: %3) granted permission to user %2

Fields

Message

Shadow View Permission Denied

User %1 (Session ID: %3) denied permission to user %2

Fields

Message

Shadow Control Permission Granted

User %1 (Session ID: %3) granted permission to user %2

Fields

Message

Shadow Control Permission Denied

User %1 (Session ID: %3) denied permission to user %2

Fields

Message

Shadow Session Failure

User %2 encountered error %3 trying to shadow user %1 (Session ID: %4)

Fields

Message

Shadow Session Failure

User %2 was unable to shadow user %1 (Session ID: %3) because of group policy settings.

Fields

Message

Shadow Session Failure

User %2 was unable to shadow user %1 (Session ID: %3) because that session is already being shadowed.

Fields

Message

Session %1 has been idle over its time limit, and was logged off

Fields

Message

Session %1 has been idle over its time limit, and was disconnected

Fields

Message

Session %1 has exceeded its time limit, and was logged off

Fields

Message

Session %1 has exceeded its time limit, and was disconnected

Fields

Message

Session %1 has exceeded its disconnect time limit, and was logged off

Fields

Message

User config info will be loaded from domain controller for this %1 connection

Fields

Message

User config info will be loaded from local machine for this %1 connection

Fields

Message

Shadow Session Clipboard Copy Request

User %1 on computer %2 controlling user %3 (Session ID: %4) Clipboard format: %5

Fields

Message

Connection from listener %1 will have terminal class of %2

Fields

Message

Supplemental Kerberos credentials are not configured

Message

Successfully updated supplemental Kerberos credential %1 in %2 logon session

Fields

Message

Successfully removed supplemental Kerberos credential %1 from %2 logon session

Fields

Message

Failed to update supplemental Kerberos credentials. %1

Fields

Message

Failed to update supplemental Kerberos credential %1 in %2 logon session. %3

Fields

Message

Failed to remove supplemental Kerberos credential %1 from %2 logon session. %3

Fields

Message

Supplemental Kerberos credential %1 configuration is invalid. %2

Fields

Message

Remote Desktop Service's Threadpool is in terminated state. Remote Desktop Connections may not work, this usually happens when TermService is being shutdown. If this was unintentional, restart Termservice manually.

Message

Remote Desktop Configuration service could not remove user {Param1}\{Param2} from administrators group; error Code: {Param3}

Fields

Message

Remote Desktop Configuration service could not remove user with SID {Param1} from administrators group; error Code: {Param2}

Fields

Message

Remote Desktop Configuration service has added user {Param1}\{Param2} to administrators group

Fields

Message

The remote session could not be established from remote desktop client %1 because its license could not be renewed.

Fields

Message

The Remote Desktop Session Host server cannot communicate with the Remote Desktop license server %1. Ensure that the computer account for the Remote Desktop Session Host server is a member of the RDS Endpoint Servers group on the license server.

Fields

Message

Remote Desktop Session Host server was unable to retrieve users licensing information from AD. Error %1

Fields

Message

Remote Desktop Session Host server was successfully validated %1 licensing information from AAD.

Fields

Message

Remote Desktop Session Host server was unable to retrieve user licensing information from AAD. Error %1

Fields

Message

Remote Desktop Session Host server was unable to validate RDS license. Error %1

Fields

Message

The RD Licensing grace period has expired and the service has not registered with a license server with installed licenses. A RD Licensing server is required for continuous operation. A Remote Desktop Session Host server can operate without a license server for 120 days after initial start up.

Message

The RD Licensing grace period is about to expire on %1 and the service has not registered with a license server with installed licenses. A RD Licensing server is required for continuous operation. A Remote Desktop Session Host server can operate without a license server for 120 days after initial start up.

Fields

Message

The Remote Desktop Session Host server does not have a Remote Desktop license server specified. To specify a license server for the Remote Desktop Session Host server, use the Remote Desktop Session Host Configuration tool.

Message

The Remote Desktop Session Host server could not contact the Remote Desktop license server %1. Ensure that the Remote Desktop Licensing service is running on the license server, that the license server is accepting network requests, and that the license server is registered in WINS and DNS.

Fields

Message

The Remote Desktop license server %1 does not support the version of the operating system running on the Remote Desktop Session Host server.

Fields

Message

The certificate issued by the Remote Desktop license server to the Remote Desktop Session Host server is not valid. The license server will not issue Remote Desktop Services client access licenses to clients connecting to the Remote Desktop Session Host server. To resolve this issue, delete the certificate on the Remote Desktop Session Host server and then restart the Remote Desktop Services service.

Message

The Remote Desktop Virtualization Host server cannot issue a client license.  It was unable to issue the license due to a changed (mismatched) client license, insufficient memory, or an internal error. Further details for this problem may have been reported at the client's computer.

Message

The RD Licensing grace period has expired and Licensing mode for the Remote Desktop Virtualization Host server has not been configured. Licensing mode must be configured for continuous operation.

Message

The RD Licensing grace period has expired and the service has not registered with a license server with installed licenses. A RD Licensing server is required for continuous operation. A Remote Desktop Virtualization Host server can operate without a license server for 120 days after initial start up.

Message

The RD Licensing grace period is about to expire on %1 and the service has not registered with a license server with installed licenses. A RD Licensing server is required for continuous operation. A Remote Desktop Virtualization Host server can operate without a license server for 120 days after initial start up.

Fields

Message

The Remote Desktop Virtualization Host server does not have a Remote Desktop license server specified. To specify a license server for the Remote Desktop Virtualization Host server, use the RDS module for Windows PowerShell.

Message

The Remote Desktop Virtualization Host server could not contact the Remote Desktop license server %1. Ensure that the Remote Desktop Licensing service is running on the license server, that the license server is accepting network requests, and that the license server is registered in WINS and DNS.

Fields

Message

The Remote Desktop license server %1 does not support the version of the operating system running on the Remote Desktop Virtualization Host server.

Fields

Message

The certificate issued by the Remote Desktop license server to the Remote Desktop Virtualization Host server is not valid. The license server will not issue licenses to clients connecting to the Remote Desktop Virtualization Host server. To resolve this issue, delete the certificate on the Remote Desktop Virtualization Host server and then restart the Remote Desktop Services service.

Message

The Remote Desktop Virtualization Host server cannot communicate with the Remote Desktop license server %1. Ensure that the computer account for the Remote Desktop Virtualization Host server is a member of the RDS Endpoint Servers group on the license server.

Fields

Message

Remote session from client name %1 exceeded the maximum allowed failed logon attempts. The session was forcibly terminated.

Message

TermService clustering failed to redirect a client to an alternate clustered server, ntstatus=%1.

Message

TermService clustering failed to initialize because the Session Directory Provider failed to initialize, hresult=%1.

Message

RD Session Host Server listener stack was down. The relevant status code %1.

Message

RD Session Host Server session creation failed. The relevant status code was %1.

Message

Autoreconnect failed to reconnect user to session because authentication failed. (%1)

Message

Failed to load RD Session Host Server Profile path. Note that the profile path must be less than 256 characters in length. User Name: %1 Domain: %2

Message

The RD Session Host Server listener %1 is configured with inconsistent authentication and encryption settings. The Encryption Level is currently set to %2 and Security Layer is set to %3. These settings were automatically corrected to allow connections to proceed. Please change the Security Layer and Encryption Level settings in Group Policy or by using the Remote Desktop Session Host Configuration tool in the Administrative Tools folder.

Message

The RD Session Host Server is configured to use SSL with user selected certificate, however, no usable certificate was found on the server. The default certificate will be used for RD Session Host Server authentication from now on. Please check the security settings by using the Remote Desktop Session Host Configuration tool in the Administrative Tools folder.

Message

The RD Session Host Server is configured to use a certificate that will expire in %2 days. %1 The SHA1 hash of the certificate is in the event data. Please check the security settings by using the Remote Desktop Session Host Configuration tool in the Administrative Tools folder.

Message

The RD Session Host Server is configured to use a certificate that is expired. %1 The SHA1 hash of the certificate is in the event data. The default certificate will be used for RD Session Host Server authentication from now on. Please check the security settings by using the Remote Desktop Session Host Configuration tool in the Administrative Tools folder.

Message

The RD Session Host Server is configured to use a certificate that does not contain an Enhanced Key Usage attribute of Server Authentication. %1 The SHA1 hash of the certificate is in the event data. The default certificate will be used for RD Session Host Server authentication from now on. Please check the security settings by using the Remote Desktop Session Host Configuration tool in the Administrative Tools folder.

Message

The RD Session Host Server is configured to use a certificate but is unable to access the private key associated with this certificate. %1 The SHA1 hash of the certificate is in the event data. The default certificate will be used for RD Session Host Server authentication from now on. Please check the security settings by using the Remote Desktop Session Host Configuration tool in the Administrative Tools folder.

Message

A new self signed certificate to be used for RD Session Host Server authentication on SSL connections was generated. The name on this certificate is %1. The SHA1 hash of the certificate is in the event data.

Message

The RD Session Host Server has failed to create a new self signed certificate to be used for RD Session Host Server authentication on SSL connections. The relevant status code was %1.

Message

The RD Session Host Server has failed to replace the expired self signed certificate used for RD Session Host Server authentication on SSL connections. The relevant status code was %1.

Message

The RD Session Host Server authentication certificate configuration data was invalid and the service reset it. If the computer was configured to use a specific certificate, please verify it is available in the certificate store and use the administrative tools to select it again.

Message

The Remote Desktop Services User Home Directory was not set because the path specified does not exist or not accessible. The default Home Directory Path was used instead. User Name: %1 Domain: %2

Message

Remote Desktop Session Host server was unable to retrieve users Licensing information from AD. Error {errorCode}

Fields

Message

The RD Session Host server is configured to use a template-based certificate for Transport Layer Security (TLS) 1.0\Secure Sockets Layer (SSL) authentication and encryption, but the subject name on the certificate is invalid. %1 The SHA1 hash of the certificate is in the event data. Therefore, the default certificate will be used by the RD Session Host server for authentication. To resolve this issue, make sure that template used to create this certificate is configured to use DNS name as subject name .

Message

A new template-based certificate to be used by the RD Session Host server for Transport Layer Security (TLS) 1.0\Secure Sockets Layer (SSL) authentication and encryption has been installed. The name for this certificate is %1. The SHA1 hash of the certificate is provided in the event data.

Message

The RD Session Host server cannot install a new template-based certificate to be used for Transport Layer Security (TLS) 1.0\Secure Sockets Layer (SSL) authentication and encryption. The following error occured: %1.

Message

The template-based certificate that is being used by the RD Session Host server for Transport Layer Security (TLS) 1.0\Secure Sockets Layer (SSL) authentication and encryption has expired and cannot be replaced by the RD Session Host server. The following error occurred: %1.

Message

RD Session Host Server was unable to process session arbitration request. Error %1

Message

The RD Session Host server cannot register 'TERMSRV' Service Principal Name to be used for server authentication. The following error occured: %1.

Message

A logon request was denied because the RD Session Host server is currently in drain mode and therefore not accepting new user logons. To configure the server to allow new user logons, use the Remote Desktop Services Configuration tool.

Message

A connection request was denied because the RD Session Host server is currently configured to not accept connections. To configure the server to allow connections, use the chglogon command-line tool.

Message

The cn column for the template-based certificate %1 returned an unknown data type %2.

Message

The msPKI-Cert-Template-OID column for the template-based certificate %1 returned an unknown data type %2.