SCOM 2012 Sp1- Remote Desktop Attempt to send disconnect event id:20 disable

Hello All,

In our RDS environment every few days we are getting following RDS alert, "Attempt to send disconnect message to Windows video subsystem failed. The relevant status code was 0xffffffffd0000001. and event numuber 20". We contacted MS support and they told us that we can suppress this message.

But according to configuration for this monitor, "You are viewing the XML configuration of this object because the MP does not define a specific  UI to configure this object type" I would like to monitor everything in the XML besides the event id:20. My question is how do I modify the xml in the configuration to remove  or suppress this alert? Below is the xml configuration, sorry it is quite large.

<Configuration>   <FirstComputerName>$Target/Host/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</FirstComputerName>   <FirstLogName>Microsoft-Windows-TerminalServices-LocalSessionManager/Operational</FirstLogName> - <FirstExpression> - <And> - <Expression> - <SimpleExpression> + <ValueExpression>   <XPathQuery
Type
="String">Channel</XPathQuery>   </ValueExpression>   <Operator>Equal</Operator> - <ValueExpression>   <Value Type="String">Microsoft-Windows-TerminalServices-LocalSessionManager/Operational</Value>   </ValueExpression>   </SimpleExpression>   </Expression> - <Expression> - <Or> - <Expression> - <SimpleExpression> - <ValueExpression>   <XPathQuery
Type
="UnsignedInteger">EventDisplayNumber</XPathQuery>   </ValueExpression>   <Operator>Equal</Operator> - <ValueExpression>   <Value Type="UnsignedInteger">20</Value>   </ValueExpression>   </SimpleExpression>   </Expression> - <Expression> - <SimpleExpression> - <ValueExpression>   <XPathQuery
Type
="UnsignedInteger">EventDisplayNumber</XPathQuery>   </ValueExpression>   <Operator>Equal</Operator> - <ValueExpression>   <Value Type="UnsignedInteger">16</Value>   </ValueExpression>   </SimpleExpression>   </Expression> - <Expression> - <SimpleExpression> - <ValueExpression>   <XPathQuery
Type
="UnsignedInteger">EventDisplayNumber</XPathQuery>   </ValueExpression>   <Operator>Equal</Operator> - <ValueExpression>   <Value Type="UnsignedInteger">17</Value>   </ValueExpression>   </SimpleExpression>   </Expression>   </Or>   </Expression>   </And>   </FirstExpression>   <SecondComputerName>$Target/Host/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</SecondComputerName>   <SecondLogName>Microsoft-Windows-TerminalServices-LocalSessionManager/Operational</SecondLogName> - <SecondExpression> - <And> - <Expression> - <SimpleExpression> - <ValueExpression>   <XPathQuery
Type
="String">Channel</XPathQuery>   </ValueExpression>   <Operator>Equal</Operator> - <ValueExpression>   <Value Type="String">Microsoft-Windows-TerminalServices-LocalSessionManager/Operational</Value>   </ValueExpression>   </SimpleExpression>   </Expression> - <Expression> - <Or> - <Expression> - <SimpleExpression> - <ValueExpression>   <XPathQuery
Type
="UnsignedInteger">EventDisplayNumber</XPathQuery>   </ValueExpression>   <Operator>Equal</Operator> - <ValueExpression>   <Value Type="UnsignedInteger">18</Value>   </ValueExpression>   </SimpleExpression>   </Expression> - <Expression> - <SimpleExpression> - <ValueExpression>   <XPathQuery
Type
="UnsignedInteger">EventDisplayNumber</XPathQuery>   </ValueExpression>   <Operator>Equal</Operator> - <ValueExpression>   <Value Type="UnsignedInteger">19</Value>   </ValueExpression>   </SimpleExpression>   </Expression>   </Or>   </Expression>   </And>   </SecondExpression>

 </Configuration>

Thank You in advance for reading and answering.

Pete

September 5th, 2013 9:28pm

Hello Natalya,

Thank you for your suggestion, I had already checked out the above link and it was not applicable to my scenario. We had contacted Microsoft and they told us that we can safely ignore this alert. Due to this I would like to modify the XML and rem out the event it: 20 out of the configuraiton.

Thank You,

(pete)....

September 9th, 2013 9:22pm

Hi pfunck,

I know this thread is old, but I'd like to surpress Event ID: 20 also within our SCOM setup. 

Did you ever find a fix to rem this out?

Free Windows Admin Tool Kit Click here and download it now
July 21st, 2015 5:16am

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics