I have two RDS servers running Server 2012, and since a couple of days users are reporting they get disconnected often. In the eventlogs, I found a couple of events where a user was disconnected without further information. I also found a lot of "Failed to create KVP sessions string" events. I couldn't find any relevant information about this event, but it appears the most at moments when users are being disconnected from the RDS server.

This is the event:

Log Name:      Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational
Source:        Microsoft-Windows-TerminalServices-RemoteConnectionManager
Date:          3/12/2013 10:01:26 AM
Event ID:      1152
Task Category: None
Level:         Error
Keywords:     
User:          SYSTEM
Computer:      TS02.contoso.com
Description:
Failed to create KVP sessions string. Error Code 0x8007007A
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-TerminalServices-RemoteConnectionManager" Guid="{C76BAA63-AE81-421C-B425-340B4B24157F}" />
    <EventID>1152</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x1000000000000000</Keywords>
    <TimeCreated SystemTime="2013-03-12T09:01:26.771581100Z" />
    <EventRecordID>11344</EventRecordID>
    <Correlation />
    <Execution ProcessID="836" ThreadID="840" />
    <Channel>Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational</Channel>
    <Computer>TS02.contoso.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns="Event_NS">
      <Param1>2147942522</Param1>
    </EventXML>
  </UserData>
</Event>

Does someone have any idea what might cause this error? Thanks!

Wow, nobody has ever seen this before?

Seeing this right now. Found a solution yet?

I haven't heard any user complaints so far, I get notifications about Remote Desktop Services Licensing Mode though. Will ivestigate further and report back if I find answers.

Seeing this right now. Found a solution yet?

I haven't heard any user complaints so far, I get notifications about Remote Desktop Services Licensing Mode though. Will ivestigate further and report back if I find answers.

Please let me know, I haven't found a solution so far.

Sorry for my english wich will not be very good.

I've the same problem which causes deconnection of all users. It will also stops the Remote Desktop Services on the RD server and causes the failing of the Remote Desktop Licensing Manager on an other server which hosts this role.

I hope somebody can help us.

Bests regards.

Michel ECHAROUX

To complete my post, we discover lots of problems with Windows 2012 RDS :

RDP sessions disconnected 3 or 4 times a day.

Licence manager fails at the same time.

The "Num Lock" is off after opening a session (the light is on but the fonction is off) => we have to push the button (light off) to active the "Num Lock" !

We hope a rapid solution from Microsoft and at this time, we decided to reinstall Windows 2008R2 instead of Windows 2012.

Its a pity that Microsoft lauch unfinished products !

Bests regards,

Michel ECHAROUX.

Me too,

I purchase enough RDP Lic, and my lic report says I have 20, 2 were issued, 18 available, and the report still lists all failed request for RDP lic, my RDP session host has whole bunch of such error events. My users complains about slow RDP session, and got disconnect often. I read somewhere that the RDP Lic server and RDP Session host needs to be co-certified with each other. May be it is the issue of session host doesn't trust RDP server, so the get RDP Lic failed, and users can bad RDP session. I use RDP to render my ERP (Dynamics GP), for slower(low end) data users, I let them use ERP as RDP remote apps. For heavy ERP users, I installed client on their desktops, now, my heavy users are faster than my RDP users.  It shouldn't be, so the problem is definitely between RDP Lic and RDP Session Host.

When will Microsoft fix this issue? More and more users are getting disconnected at random.

Never had this problem with older versions of Windows Server.

I have gotten this error over 300 times in one day. No users are reporting being kicked off or anything and I am not having any problems with the Remote Desktop Services service being interrupted. I am not sure what is causing it. I am pretty sure we're not having users disconnect 300 times per day. Although, the event does not occur at night (when people aren't using it) so it's hard to say at this point what could be causing it. I will have to investigate it further.

I keep getting this message in our Event Viewer, and at first it was just like Dennis Nolen Jr said, no users were reporting being kicked off or anything. Now though, I'm experiencing random disconnects for our users... trying to get to the bottom of this. Any suggestions?

I am seeing a similar error with one of my customers.

The RDS server in question is Windows 2012 R2 residing in Azure.

The users are seeing a disconnected, trying 1 of 20 dialog box.

Has anyone opened a case with Microsoft on this?

We are experiencing this same issue with most of our wireless users run RDP sessions. This is a Windows server running Windows 2012 Datacenter with a Hyper-V failover cluster configured. Have there been any further updates on this topic?

This is the below response that I received from our Microsoft TAM, the response cam direct from a member of the RDS team (we have a very good relationship with MS!)

I don't get their "Domain Admin" fix though! sounds a little random to me, I'm yet to try the fix as I have other project work on at the moment.

EVENTID:             1152
Severity:              ERROR
Source:                 Microsoft-Windows-TerminalServices-RemoteConnectionManager
Data:                     Failed to create KVP sessions string. Error Code 0x8007007A<u3:p> </u3:p>

There are thousands of these entries in the event log.

I have 4000+ of these events in the last 24 hours. But this has been happening since we first started the 2012R2 Pilot (we now have 400-500 users on it)

Symptom
Getting Event 1152
Failed to create KVP sessions string. Error Code 0x8007007A

Cause
Licensing issue
Resolution

n Please apply the following local GPO:

Start->gpedit.msc-> Browse to -> COMP Configuration >> Admin template >> Windows Components>>Remote Desktop Services >>Remote Desktop Session Host >>Licensing<u3:p> </u3:p>

use the specified remote desktop license servers. 

Set the remote desktop licensing mode.

n Start->cmd(run as admin)->gpupdate /force <u3:p> </u3:p>

n Please also on the Domain controller add the computer account of the connection Broker and the licensing server to the domain admins group.

n On the session host server please add the Computer and Network service account to the RDS Endpoint server and RDS  Management servers.

Reboot the server

Hello,

same problem here, "Failed to create KVP sessions string. Error Code 0x8007007A" and random disconnect/reconnect (briefly).

I also have "The RDP protocol component X.224 detected an error" in RemoteDesktopServices-RDPCoreTS.

RDS virtual farm on hyper-v failover cluster. There is no errors on the license server (and yes I have followed the best practice for the case "RD licensing server on a DC") , the license diag is also OK.

• Edited by Ludovic HARLAUT Friday, August 01, 2014 10:24 AM

I am chiming in to say that I have been having this issue for over a month as well.  I tried all the above fixes and I even recreated the licensing 2 weeks ago.  Everything is going fine licensing wise and we are supporting around 100 users for rd web.  We do get some complaints about disconnects but luckily it isn't too widespread.

These errors are still popping up on our 4 servers a lot and it is a bit worrisome.

case open, will see if it is a misconfiguration or if we have to wait for a patch...

You also have this configuration: rdweb ---> rd Gateway ---> rd broker ---> RDSH?

case open, will see if it is a misconfiguration or if we have to wait for a patch...

You also have this configuration: rdweb ---> rd Gateway ---> rd broker ---> RDSH?

Yes we have that exact set up.

We also have a huge amount of such errors on 2012 R2 servers. They're not related to licensing (at least according to the RD Licensing diagnoser). 

Also it's interesting that on sundays and early at morning (when there are less than approximately ten users) errors don't occur.

• Edited by Leonid Kuritsyn Monday, August 11, 2014 10:56 AM

Can you have a look if you have these errors in eventlog application on the RD Gateway (it appears generally after a reboot):

Event 455 source:ESENT

svchost (20400) Error -1032 (0xfffffbf8) occurred while opening logfile C:\Windows\system32\LogFiles\Sum\Api.log.

Event 489 source:ESENT

svchost (20400) An attempt to open the file "C:\Windows\system32\LogFiles\Sum\Api.log" for read only access failed with system error 5 (0x00000005): "Access is denied. ".  The open file operation will fail with error -1032 (0xfffffbf8).

Event 490 source:ESENT

svchost (20400) An attempt to open the file "C:\Windows\system32\LogFiles\Sum\Api.chk" for read / write access failed with system error 5 (0x00000005): "Access is denied. ".  The open file operation will fail with error -1032 (0xfffffbf8).

Thx

• Edited by Ludovic HARLAUT Friday, August 08, 2014 10:22 AM

Can you have a look if you have these errors in eventlog application on the RD Gateway (it appears generally after a reboot):

Event 455 source:ESENT

svchost (20400) Error -1032 (0xfffffbf8) occurred while opening logfile C:\Windows\system32\LogFiles\Sum\Api.log.

Event 489 source:ESENT

svchost (20400) An attempt to open the file "C:\Windows\system32\LogFiles\Sum\Api.log" for read only access failed with system error 5 (0x00000005): "Access is denied. ".  The open file operation will fail with error -1032 (0xfffffbf8).

Event 490 source:ESENT

svchost (20400) An attempt to open the file "C:\Windows\system32\LogFiles\Sum\Api.chk" for read / write access failed with system error 5 (0x00000005): "Access is denied. ".  The open file operation will fail with error -1032 (0xfffffbf8).

Thx

I do have these errors on my gateway.  They did occur just after a reboot as well.

You can fix these errors with the KB article: http://support.microsoft.com/kb/2811566/en-us , for the local Network Service account. But no joy, it doesn't fix anything else. Microsoft is very busy ATM, so the case doesn't move fast.

Edit:

After some search on internet about the disconnection problem you can find some ressources here:

http://social.technet.microsoft.com/Forums/windowsserver/en-US/bd96e1a9-81ec-4306-bacc-4cff442d30c8/rds-2012-http-udp-gateway-connections-reset?forum=winserverTS

http://forums.mydigitallife.info/threads/53365-Can-I-downgrade-RDP-from-8-1-to-8-on-Windows-8-1

• Edited by Ludovic HARLAUT Tuesday, August 12, 2014 8:45 AM

Below is the latest update I have on my case... The case is currently parked for a bigger RDS problem where we see winlogon crashing on our connection brokers. Once the case is resumed I will post the findings...

EVENTID: 1152
Severity: ERROR
Source: Microsoft-Windows-TerminalServices-RemoteConnectionManager
Data: Failed to create KVP sessions string. Error Code 0x8007007A

We checked the code for this error and it seems that when it enumerates the session information for existing sessions, it will save lots of information. The error code is 0x8007007A, which means that ERROR_INSUFFICIENT_BUFFER, The data area passed to a system call is too small.

 

Based on my research on the internal data base, it is an expected behavior if we have more remote session to the VM RDP server. And this can be safely ignored as it only record the session information for logging.

 

The reason of the error event is exact ERROR_INSUFFICIENT_BUFFER, because the buffer size was hardcoded to 1024 bytes in OS.

 

Also, I have recommendation to try the step as per the KB article http://support.microsoft.com/kb/2030310   and choose method 2 to delegate the permissions and check if that helps us.

 

Method 2: Use the Delegate Control Wizard to add the permissions to add read\write permissions to the terminalServer attribute or to the Terminal Server License Server attribute of the user object by the Terminal Server License Servers group. To do this, follow these steps:

1.       Right-click the domain in Active Directory Users and Computers, and then click Delegate Control.
2.       In the Users and Groups dialog box, click Add. Type Terminal Server License Servers, and then click OK. In the Users and Groups dialog box, click Next.
3.       In the Tasks to Delegate dialog box, click Create a custom task to delegate, and then click Next.
4.       In the Active Directory Object Type dialog box, click Only the following objects in the folder. In the list, click User objects (the last entry that is in the list), and then click Next.
5.       Do one of the following, according to the operating system that the domain controller is running:
   1.       For forests that are running Windows Server 2008 or newer Schema:
      
      In the Permissions dialog box, make sure that only the General check box is selected. In the Permissions list, click to select the Read and Write Terminal Server license server check box, and then click Next.

In the Completing the Delegation of Control Wizard dialog box, click Finish.

I have the same issue and customers are complaining.

We do not have AD set up and I'm not a full server expert.

Is there a way to fix this issue on workgroup level?

My case is still parked... Will update when it is resumed.

Hi we have the same error of 1152

Failed to create KVP sessions string. Error Code 0x8007007A

:(

Just to compare notes (I dont have an answer to this fix yet - its gone as far as the product group now for repro!) how is your environment confirgured and how many users do you have? I think its something around multiple logons of the same user (we have a bunch of kiosk machines sharing an account).

It depends how many sessions are logged in on the RDS host. If you add more RDSH hosts to the RD farm to reduce the number of concurrent sessions logged in, the errors are gone.

My guess is, that the TS license check enummerates the sessions periodically and this license check implementation is crap.

As far as I see now, there are no errors up to eight sessions per RDSH. With nine and up you will see the 1152 events and sessions are droppet. Can anybody confirm these numbers?

• Edited by Martin Brulisauer Thursday, January 29, 2015 2:29 PM

http://support.microsoft.com/kb/2030310  does not work on 2012 R2 RDSH hosts.

Lowest number of users I'm working with are 30-40 to an RDSH host... We found the problem occurred less when we scaled the farm out rather than up, but with 60+ RDSH and 2000-2500 users its a beast to manage. We also find that as the number of users increase (much above 500) we start to see Blocking locks on the SQL side... Again, we have a case open (since August!) The MS product team have just mocked up a repro environment and I'm awaiting feedback.

Sorry for jumping in but event ID 1152 started to appear on one of my RDSH. I will follow this thread with great interest.

Same. I'm almost tempted to bite the bullet and contact Microsoft.

Well, we finally closed my case! Looks like anything more than 500 users to a HA connection broker farm doesn't work! Not good when we have a few thousand RDS users :-( Being re-designed in vNEXT and back ported to 2012R2 (according to the product group). time to revive all the other RDS cases we have open!

Interesting - we have split out a number of RDSH hosts from the connection brokers and stuck an F5 Loadbalancer in front of them, EventID1152 is gone on those boxes... This ONLY affects servers involved in connection brokering.

Everyone with this error should attempt to raise a case with MS. Its a BUG!