RDP access issues after latest updates

[sraper]

I am having an annoying issue with certain servers running Server 2022.

 

This may or may not be relevant but all servers affected are in LGfL schools.

 

I am unable to login using RDP this using either RDP from another machine on the same network in the school, or from another school (in LGfL) or via the LGfL RDP Gateway. Can still get on using Splashtop.

 

This is the error I get

 

 

It appears to be linked to update KB5028171 and specifically I would guess CVE-2023-32043 (as this references RDP).

 

The problem is on some servers with KB5028171 it will continue to work for a week or so before it starts failing. Some servers we can roll back this update and yet at other schools it wont let us! On the servers where I can roll back the update it WILL FIX the problem - until the update is reinstalled

[sraper]

I forgot to say that on servers that work (no update) that the version of C:\Windows\system32\termsrv.dll is 10.0.20348.1668. The version that does not work is 10.0.20348.1850

[sraper]

no one else having problems with rdp'ing onto server 2022 with latest updates applied

[Steve21]

Is it a super micro server? There have been a number of reports onthe German forums regarding issues with RDP after that patch but only related to super micros

 

Just wondering if that might be why you are seeing it and others aren’t

 

Steve

[sraper]

No they are Dell servers - did look at the graphics drivers as had been old reports of issues with Matrox VGA drivers - pretty sure that it is not this causing the problem. All servers were working fine until updates listed in OP were installed - however issues do not start straight away but maybe a few days later. Sometimes rebooting the server will allow RDP to work for a short while before failing again.

[Noxid_w]

Having this exact same issue. Absolutely driving me insane. Did you ever get a resolution in the end?

[Noxid_w]

I forgot to say that on servers that work (no update) that the version of C:\Windows\system32\termsrv.dll is 10.0.20348.1668. The version that does not work is 10.0.20348.1850

 

My server that is not working is 10.0.20348.1668 but it's that on my servers that are working so I'm not sure it's that. At least not for me.

[sraper]

I wish!

 

I think we have nearly 10 schools affected now. Luckily they are mostly lgfl so can get around it using vnc via freedom2roam. But that is unpleasant 😞

[sraper]

My server that is not working is 10.0.20348.1668 but it's that on my servers that are working so I'm not sure it's that. At least not for me.

 

What make model of server are you having problems with

[Noxid_w]

What make model of server are you having problems with

It's a Windows 2022 VM running running on a Dell R650 with Failover Cluster. This is the only VM doing it though. I'm scared to update anything now though. I can't see this issue being reported anywhere else.

[Noxid_w]

Just wanted to update you, I resolved the issue by giving the VM another CPU core. When doing more diagnostic, the CPU was spiking and hovering between 95%-100% which I think was just causing all sorts of weird issues, like failing RDP connections. My only defense, I inherited this network and server only fairly recently. It's odd that it's only just started misbehaving following a recent update, but then again I've seen weirder things after Windows updates.

 

I'm not saying it's the same issue for you, but maybe make sure your CPU performance is not spiking on those services at all.

[sraper]

We believe we have resolved our issue.

 

It was the backup software of all things

BackupAssist Classic v12.0.4r1

 

Released August 28^th, 2023

Urgent fix release

 

 

• Urgent: Avoid “black screen” and other Remote Desktop/Team Viewer connection issues after reboots on installations that have applied Windows update KB5028166 on Windows 11 and KB5028171 on Windows Server 2022.
  
  • The root cause is a change in the OS that causes some services to fail to start when driver operations are unexpectedly handled as failures (eg. in CryptoSafeGuard Shield, various Anti-Malware drivers, etc).
    

 

The Backup software has a level of built in malware protection and somehow there was a conflict after above mentioned update KB5028166

Edited September 28, 2023 by sraper