We're experiencing a lot of random disconnects in the connections between Windows 7 clients and our RDSH 2012R2 farm (using RDGW). In the logs on the client event 1026 shows up in Microsoft-Windows-TerminalServices-ClientActiveXCore with mainly one of the following disconnect reasons: 1289, 4360, 50331661, 50331673, 50331694, 50331698 or 50331722.
Notice there are low reasons (4 chars) and high reasons (8 chars). These disconnects don't seem to occur in patterns as some connections last a few minutes before disconnecting while others flawlessly worked for over 5 hours.

I've searched across this forum and there are many threads about these disconnects.
This thread is the most clear one and does exactly point out our problem. Unfortunately it doesn't provide an answer.
(Please note: Event 1026 on Windows Server 2003 refers to a TS licencing problem, but on Server 2012 this event is not about licensing!)

Event 1026 on ClientActiveXCore seems to be generated by a dll, apparently mstscax.dll.
There are some disconnect reasons published in https://msdn.microsoft.com/en-us/library/aa381339.aspx and https://msdn.microsoft.com/en-us/library/aa382170.aspx, but the most occuring ones in our logfiles (1289 and 4360) aren't explained.
Can anyone (perhaps a Microsoft employee?) give us a clue what these disconnect reason mean?

Thanks in advance!

Hi,

Thank you for your posting.

I am trying to involve someone familiar with this topic to further look at this issue. There might be some time delay. Appreciate your patience.

Best Regards,

Amy

Hello,

My understanding is that, you would like to know the exact disconnection reason for the following codes:

1289
4360
50331661
50331673
50331694
50331698
50331722

These codes are logged with the Event 1026 when the remote session disconnects.

If the information is not available in public documents. I believe it can be found in the Source Code. However source code level information is normally not allowed to be share in public.

I will see if I can find someone who has the information, and if yes, whether that can be shared (not guaranteed though).

Also lets see if anyone in the forum who happens to know the meaning of any of these codes.

Regards,
Benni

Hi,

Can you see if time between client and domain controller is synced? You can user err.exe tool to find the information about the codes.

- Umesh.S.K

• Edited by Umesh S K 19 hours 38 minutes ago

Hi all,
Thanks for replying, we appreciate it!

@ Amy & Bennie:
It's correct we're looking for an explanation of these error codes so we can investigate this problem further. I've gathered these distinct disconnect codes from several client computers, but i'm sure there are more undocumented reasons. Those MSDN articles i've mentioned in the start post are a good start though, but a longer list with more reasons and explanations would be great for engineers troubleshooting these connection issues.

Here is an XML view of the error.
The eventid is always 1026 and the eventdata value is one of those mentioned above.

- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
  <Provider Name="Microsoft-Windows-TerminalServices-ClientActiveXCore" Guid="{28AA95BB-D444-4719-A36F-40462168127E}" />
  <EventID>1026</EventID>
  <Version>0</Version>
  <Level>4</Level>
  <Task>101</Task>
  <Opcode>11</Opcode>
  <Keywords>0x4000000000000000</Keywords>
  <TimeCreated SystemTime="2015-07-15T11:09:06.884662900Z" />
  <EventRecordID>6851</EventRecordID>
  <Correlation ActivityID="{2F33BDD7-F69E-4C8B-A4CA-31FA9BE70000}" />
  <Execution ProcessID="1236" ThreadID="1412" />
  <Channel>Microsoft-Windows-TerminalServices-RDPClient/Operational</Channel>
  <Computer>FQDN</Computer>
  <Security UserID="SID" />
  </System>
- <EventData>
  <Data Name="Name">Disconnect Reason</Data>
  <Data Name="Value">50331698</Data>
  <Data Name="CustomLevel">Info</Data>
  </EventData>
  </Event>

@ Umesh.S.K:
The clients are domainmembers, so there should not be any issues with timing. The err.exe tool doesn't provide any help here. The codes with 4 chars are not found and the codes with 8 chars seem to resolve to unrelated causes.

Hi,

I've got the followings.

1289  "Server not configured for SSL"
4360 "UI: Internally triggered Reconnect"
50331661 "PROXY_ERR_UNAVAILABLE"
50331673 "PROXY_ERR_CONNECTIONABORTED"
50331694 "PROXY_ERR_NETWORKDOWN"
50331698 "PROXY_ERR_IDLETIMEOUT"
50331722 "PROXY_ERR_DUALCHANNEL_WEBPROXY_ISSUE"

These are the description of the codes.

I personally feel it may not be really helpful to understand the scenarios by solely looking at the descriptions. To better understand why the code are triggered, it involveds debugging, and I would suggest you contact the CSS to get an engineer doing that.

Regards,
Benni