RDS Users being randomly logged off

[jrviola]

The following post on this site shows the exact same errors I am seeing after running sfc /scannow: [SOLVED] - Server 2022 : SFC and DISM unable to fix corrupt files, the potential cause of Serverwide issue?

In our case, RDS users are being logged off randomly, sometimes when idle, other times when active. I found a couple of DCOM errors in the logs that seemed to correspond to timing of the logoffs and addressed those. The frequency of the logoffs decreased, but it is still occurring. Hoping to get some help here...

Thanks in advance,
Jim

 

[jrviola]

I just realized the CBS file did not upload (too large). Here is the link: Gofile - Free file sharing and storage platform

Also, from the CBS log file:

2022-10-08 13:02:19, Info CSI 00000132 Hashes for file member [l:23]'tls_branding_config.xml' do not match.
Expected: {l:32 ml:33 b:045852938e96aa28197993a6efc401407d94185aff8c13172ad3252ff711ba45}.
Actual: {l:32 b:8e6adaf781147f87780c1dd37e63b529f4a49482d541a7f417fe46458f395047}.
2022-10-08 13:02:19, Info CSI 00000133 [SR] Cannot repair member file [l:23]'tls_branding_config.xml' of Microsoft-Windows-TerminalServices-LicenseServer-TlsBrand, version 10.0.20348.1, arch amd64, nonSxS, pkt {l:8 b:31bf3856ad364e35} in the store, hash mismatch
2022-10-08 13:02:20, Info CSI 00000134 Hashes for file member [l:23]'tls_branding_config.xml' do not match.
Expected: {l:32 ml:33 b:045852938e96aa28197993a6efc401407d94185aff8c13172ad3252ff711ba45}.
Actual: {l:32 b:8e6adaf781147f87780c1dd37e63b529f4a49482d541a7f417fe46458f395047}.
2022-10-08 13:02:20, Info CSI 00000135 [SR] Cannot repair member file [l:23]'tls_branding_config.xml' of Microsoft-Windows-TerminalServices-LicenseServer-TlsBrand, version 10.0.20348.1, arch amd64, nonSxS, pkt {l:8 b:31bf3856ad364e35} in the store, hash mismatch
2022-10-08 13:02:20, Info CSI 00000136 [SR] This component was referenced by [l:136]'Microsoft-Windows-Server-Gui-Mgmt-Package-termsrv~31bf3856ad364e35~amd64~~10.0.20348.1.Microsoft-Windows-Server-Gui-Mgmt-Package-termsrv'
2022-10-08 13:02:20, Info CSI 00000137 [SR] This component was referenced by [l:101]'Microsoft-Windows-TerminalServices-Licensing-Package~31bf3856ad364e35~amd64~~10.0.20348.681.Licensing'
2022-10-08 13:02:20, Info CSI 00000138 [SR] This component was referenced by [l:107]'Microsoft-Windows-TerminalServices-Licensing-UI-Package~31bf3856ad364e35~amd64~~10.0.20348.681.Licensing-UI'
2022-10-08 13:02:20, Info CSI 00000139 [SR] This component was referenced by [l:128]'Microsoft-Windows-TerminalServices-AppServer-Opt-Package~31bf3856ad364e35~amd64~~10.0.20348.946.9b6e5ada60daa083ef5e29303e58e5d3'
2022-10-08 13:02:20, Info CSI 0000013a Hashes for file member [l:23]'tls_branding_config.xml' do not match.
Expected: {l:32 ml:33 b:045852938e96aa28197993a6efc401407d94185aff8c13172ad3252ff711ba45}.
Actual: {l:32 b:8e6adaf781147f87780c1dd37e63b529f4a49482d541a7f417fe46458f395047}.
2022-10-08 13:02:20, Info CSI 0000013b Hashes for file member [l:23]'tls_branding_config.xml' do not match.
Expected: {l:32 ml:33 b:045852938e96aa28197993a6efc401407d94185aff8c13172ad3252ff711ba45}.
Actual: {l:32 b:8e6adaf781147f87780c1dd37e63b529f4a49482d541a7f417fe46458f395047}.
2022-10-08 13:02:20, Info CSI 0000013c [SR] Could not reproject corrupted file \??\C:\Windows\System32\\tls_branding_config.xml; source file in store is also corrupted

 

[Maxstar]

Hi and welcome to Sysnative,

Step 1. Download

SFCFix and save it to your desktop.

Warning: This fix was written specifically for this system. Do not run this fix on another system.

• Save any work you have open, and close all programs.
• Download the attachment SFCFix.zip and save it to your desktop.
• Drag the SFCFix.zip file over the SFCFix.exe executable and release it.

• SFCFix will launch, let it complete.
• Once done, a file will appear on your desktop, called SFCFix.txt.
• Post the logfile (SFCFix.txt) as attachment in your next reply.

Step 2. Run the System File Checker. If it fails attach a new copy of the CBS log.

SFC /Scanow

 

[jrviola]

Thank you! Users will all be logged out at 4:00 p.m. EDT. I will take a snapshot and run the fix then.

Jim

 

[jrviola]

It appears to have completed successfully and sfc /scannow found no errors! Now to see if the user logoff issue is resolved...

BTW, through the process of trying to resolve the issue, I decided to spin up a 2019 server as a replacement. After all configs were in, I ran sfc /scannow and came up with the exact same errors. Any thoughts on this?

Thanks a million!
Jim

 

[Maxstar]

Hi,

You're Welcome. This kind of corruptions is a common problem on server 2019 / 2022, however, it is not entirely clear what the exact cause is.

Hopefully, the problem with the logoff's is now fixed.

 

[jrviola]

Good to know... So, as I spin up additional servers, I will likely need to fix the as well. Would the plan below work?

1. Spin up new server
2. Install all necessary roles and features
3. Submit files for SFCFix
4. Run SFCFix
5. Create a template from the repaired server for future deployments

This would assume that renaming the server in subsequent deployments and creating new domains will not be problematic.

Your thoughts?

Thanks,
Jim

 

[Maxstar]

Would the plan below work?

This will depend on how the server will be set up, and which source is being used?

I wouldn't recommend replacing files with SFCFix without taking a look at the logfiles first. I've seen different variations of this issue on server 2019 systems. Hence, I recommend to start a new thread for each other servers with similar issues.

 

[jrviola]

Thanks, will do. It appears the users made it through the day without any logoffs! I will monitor for one more day before marking it as solved. Thanks again for the help!

Jim

 

[Maxstar]

Hi,

I'm glad we could help. When users are not logged off after 60 minutes, then we can assume that the problem has been resolved.

 

[Maxstar]

Hi,

I wonder if the problem - now that we are a week later - is defenitely solved?