[Siolor]

Hi,

So my probleme is in the thread title.
Just upgrade W2K3 with the SP2, the upgrade seems to happen without any trouble, except that now, i can't reach the service by using RDP.
So, as i said in the title, there is nothing listening on the port 3389.
What did i already do to try to fix it :

- Checked if the terminal server service is running and it is : failed
- Restart the server : failed
- Installing the lastest version of rdp : failed
- Deleted the rdp-tcp and recreate it with the terminal service configuration mmc : failed
- Change the port number in the register and reboot : failed

I'm now running out of idea . So i hope someone could give me some tips or idea that i could try and hopefully get back the RDP up and running.
Any idea are welcome

Siolor

[L4ndy]

Hi,

Any windows firewall rules turned on? Tried restarting a couple of times.

What PID does netstat -aon return for 3389?

What service has Tasklist /svc associated with that PID?

[Siolor]

Hi,

Thank you to care about my case
Sorry that i forget to tell that the firewall is not running on the server.
So, as you going to see in the result of the netstat and tasklist, the process terminal service is running but there is no socket bind by this process on any port.
I'm going to keep searching, i'll add my result when i get some more info that could help.

netstat -aon

Active Connections

Proto Local Address Foreign Address State PID
TCP 0.0.0.0:25 0.0.0.0:0 LISTENING 1784
TCP 0.0.0.0:53 0.0.0.0:0 LISTENING 5160
TCP 0.0.0.0:80 0.0.0.0:0 LISTENING 4
TCP 0.0.0.0:88 0.0.0.0:0 LISTENING 448
TCP 0.0.0.0:135 0.0.0.0:0 LISTENING 800
TCP 0.0.0.0:389 0.0.0.0:0 LISTENING 448
TCP 0.0.0.0:443 0.0.0.0:0 LISTENING 1348
TCP 0.0.0.0:445 0.0.0.0:0 LISTENING 4
TCP 0.0.0.0:464 0.0.0.0:0 LISTENING 448
TCP 0.0.0.0:593 0.0.0.0:0 LISTENING 800
TCP 0.0.0.0:636 0.0.0.0:0 LISTENING 448
TCP 0.0.0.0:691 0.0.0.0:0 LISTENING 1784
TCP 0.0.0.0:1025 0.0.0.0:0 LISTENING 448
TCP 0.0.0.0:1027 0.0.0.0:0 LISTENING 448
TCP 0.0.0.0:1048 0.0.0.0:0 LISTENING 1784
TCP 0.0.0.0:1049 0.0.0.0:0 LISTENING 1784
TCP 0.0.0.0:1051 0.0.0.0:0 LISTENING 1784
TCP 0.0.0.0:1052 0.0.0.0:0 LISTENING 1784
TCP 0.0.0.0:1055 0.0.0.0:0 LISTENING 1784
TCP 0.0.0.0:1057 0.0.0.0:0 LISTENING 648
TCP 0.0.0.0:1075 0.0.0.0:0 LISTENING 2284
TCP 0.0.0.0:1133 0.0.0.0:0 LISTENING 4688
TCP 0.0.0.0:1137 0.0.0.0:0 LISTENING 4468
TCP 0.0.0.0:2069 0.0.0.0:0 LISTENING 2652
TCP 0.0.0.0:2748 0.0.0.0:0 LISTENING 5160
TCP 0.0.0.0:3268 0.0.0.0:0 LISTENING 448
TCP 0.0.0.0:3269 0.0.0.0:0 LISTENING 448
TCP 0.0.0.0:3573 0.0.0.0:0 LISTENING 1348
TCP 0.0.0.0:5060 0.0.0.0:0 LISTENING 1604
TCP 0.0.0.0:6001 0.0.0.0:0 LISTENING 4468
TCP 0.0.0.0:6002 0.0.0.0:0 LISTENING 2284
TCP 0.0.0.0:7920 0.0.0.0:0 LISTENING 2088
...

Tasklist /svc

イメージ名 PID サービス
========================= ======== ============================================
System Idle Process 0 N/A
System 4 N/A
smss.exe 312 N/A
csrss.exe 364 N/A
winlogon.exe 388 N/A
services.exe 436 Eventlog, PlugPlay
lsass.exe 448 HTTPFilter, kdc, Netlogon, NtLmSsp,
PolicyAgent, ProtectedStorage, SamSs
ati2evxx.exe 592 Ati HotKey Poller
svchost.exe 624 DcomLaunch
svchost.exe 800 RpcSs
svchost.exe 864 Dhcp, Dnscache
svchost.exe 892 LmHosts, W32Time
svchost.exe 916 AeLookupSvc, AudioSrv, Browser, CryptSvc,
EventSystem, helpsvc, lanmanserver,
lanmanworkstation, Netman, Nla, RasMan,
Schedule, seclogon, SENS, ShellHWDetection,
TrkWks, winmgmt, wuauserv, WZCSVC
spoolsv.exe 1208 Spooler
msdtc.exe 1232 MSDTC
vcagent.exe 1328 cpqvcagent
DevManBE.exe 1348 DevManBE
dfssvc.exe 1444 Dfs
svchost.exe 1524 ERSvc
avcsvc.exe 1564 HPAVC
mad.exe 1604 HP_Services
inetinfo.exe 1784 IISADMIN, RESvc, SMTPSVC
srvany.exe 1820 ISEEInit
ismserv.exe 1844 IsmServ
wscript.exe 1848 N/A
sqlservr.exe 1956 MSSQL$SQLEXPRESS
nod32krn.exe 368 NOD32krn
ntfrs.exe 648 NtFrs
svchost.exe 1404 RemoteRegistry
snmp.exe 1112 SNMP
snmptrap.exe 1568 SNMPTRAP
smhstart.exe 1652 SysMgmtHp
WCCProxy.exe 2088 WCCProxy
hpsmhd.exe 2092 N/A
cpqnimgt.exe 2244 CpqNicMgmt
CpqRcmc.exe 2372 CpqRcmc
cqmgserv.exe 2388 CqMgServ
cqmgstor.exe 2432 CqMgStor
CRSM5Invoker.exe 2496 CRSM5invoker
exmgmt.exe 2552 MSExchangeMGMT
cmd.exe 2572 N/A
java.exe 2652 N/A
rotatelogs.exe 3024 N/A
rotatelogs.exe 3032 N/A
hpsmhd.exe 3112 N/A
rotatelogs.exe 3168 N/A
rotatelogs.exe 3176 N/A
wmiprvse.exe 272 N/A
mad.exe 2284 MSExchangeSA
mssearch.exe 2832 MSSEARCH
sysdown.exe 1136 sysdown
svchost.exe 3000 W3SVC
cqmghost.exe 3088 CqMgHost
store.exe 4468 MSExchangeIS
wmiprvse.exe 4620 N/A
emsmta.exe 4688 MSExchangeMTA
svchost.exe 5760 TermService
wmiprvse.exe 6120 N/A
ati2evxx.exe 5080 N/A
explorer.exe 5212 N/A
cpqteam.exe 620 N/A
svchost.exe 212 TapiSrv
nod32kui.exe 6020 N/A
ctfmon.exe 6000 N/A
conime.exe 1344 N/A
mpbtn.exe 4172 N/A
OUTLOOK.EXE 5852 N/A
OutlookSchedule.exe 5180 N/A
OutlookScheduleBon.exe 4436 N/A
iexplore.exe 3068 N/A
iexplore.exe 3072 N/A
w3wp.exe 5788 N/A
iexplore.exe 5024 N/A
dllhost.exe 1532 COMSysApp
dns.exe 5160 DNS
w3wp.exe 2512 N/A
w3wp.exe 1796 N/A
ntvdm.exe 5540 N/A
cmd.exe 7680 N/A
tasklist.exe 6252 N/A

[Siolor]

What i tried until now.

I checked the service parameter with the command sc queryex Termservice and sc qc Termservice. I can't see anything wrong about the result :

SERVICE_NAME: Termservice
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 4 RUNNING
(NOT_STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN))
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
PID : 2960
FLAGS :
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: Termservice
TYPE : 20 WIN32_SHARE_PROCESS
START_TYPE : 3 DEMAND_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k termsvcs
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Terminal Services
DEPENDENCIES : RPCSS
SERVICE_START_NAME : LocalSystem

I start checked and compare the Registry with another server where the RDP is working fine. I found 2 small difference.

- The key [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\Terminal Server\Winstations\RDP-Tcp] "LanAdapter" that point which interface the adapter listen for some incoming connection. This key was set at 1 and the default setting is 0 (to listen on any interface). So i set it at 0 and restart the server. But nothing changed

- I notice a strange key :
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\TermService\Performance] "2003"=hex(b):d4,fd,2b,c2,3f,47,c6,01
I couldn't find a similar key on the other 2003 server, so i backup it and delete it. Reboot and not RDP yet.

I couldn't fine anyother difference in the registery.

Checked the version of "termsrv.dll" that run the service. 5.2.3790.3959. Same version as the other server.

Any idea still welcome

Siolor.

[biggles77]

Change the port as per this article and see if it listens on the new port. http://www.petri.co.il/change_termin...ening_port.htm

This link is mentioned at the bottom of the above article. http://www.petri.co.il/add_a_new_rdp...nal_server.htm

How are you trying to Remote into the Server? Internal or externally?
Have you tried using the latest RDP Client?
Do you have a Firewall installed with your anti-virus?
Can you ping the Server from a client on the same IP Range?
Have you checked the settings in the RDP Client? Anything set that would stop a connection being made?
Have you logged on locally to the Server? This is a known problem when SP2 is installed but physically logging onto the Server seemed to fix it.

[Siolor]

First of all Thank you biggles
I changed the port number of the RDP listener to 10 000

"PortNumber"=dword:00002710(10000)

Nothing are listening on the port 10000

Active Connections
Proto Local Address Foreign Address State PID
TCP 0.0.0.0:25 0.0.0.0:0 LISTENING 1740
TCP 0.0.0.0:53 0.0.0.0:0 LISTENING 1520
TCP 0.0.0.0:80 0.0.0.0:0 LISTENING 4
TCP 0.0.0.0:88 0.0.0.0:0 LISTENING 448
TCP 0.0.0.0:135 0.0.0.0:0 LISTENING 796
TCP 0.0.0.0:389 0.0.0.0:0 LISTENING 448
TCP 0.0.0.0:443 0.0.0.0:0 LISTENING 1368
TCP 0.0.0.0:445 0.0.0.0:0 LISTENING 4
TCP 0.0.0.0:464 0.0.0.0:0 LISTENING 448
TCP 0.0.0.0:593 0.0.0.0:0 LISTENING 796
TCP 0.0.0.0:636 0.0.0.0:0 LISTENING 448
TCP 0.0.0.0:691 0.0.0.0:0 LISTENING 1740
TCP 0.0.0.0:1025 0.0.0.0:0 LISTENING 448
TCP 0.0.0.0:1027 0.0.0.0:0 LISTENING 448
TCP 0.0.0.0:1034 0.0.0.0:0 LISTENING 1520
TCP 0.0.0.0:1048 0.0.0.0:0 LISTENING 1740
TCP 0.0.0.0:1049 0.0.0.0:0 LISTENING 1740
TCP 0.0.0.0:1050 0.0.0.0:0 LISTENING 1740
TCP 0.0.0.0:1051 0.0.0.0:0 LISTENING 1740
TCP 0.0.0.0:1055 0.0.0.0:0 LISTENING 1088
TCP 0.0.0.0:1060 0.0.0.0:0 LISTENING 1740
TCP 0.0.0.0:1075 0.0.0.0:0 LISTENING 2796
TCP 0.0.0.0:1136 0.0.0.0:0 LISTENING 5252
TCP 0.0.0.0:1140 0.0.0.0:0 LISTENING 4952
TCP 0.0.0.0:2069 0.0.0.0:0 LISTENING 2604
TCP 0.0.0.0:3268 0.0.0.0:0 LISTENING 448
TCP 0.0.0.0:3269 0.0.0.0:0 LISTENING 448
TCP 0.0.0.0:3573 0.0.0.0:0 LISTENING 1368
TCP 0.0.0.0:5060 0.0.0.0:0 LISTENING 1604
TCP 0.0.0.0:6001 0.0.0.0:0 LISTENING 4952
TCP 0.0.0.0:6002 0.0.0.0:0 LISTENING 2796
TCP 0.0.0.0:7920 0.0.0.0:0 LISTENING 2116
TCP 127.0.0.1:80 127.0.0.1:1197 ESTABLISHED 4
TCP 127.0.0.1:80 127.0.0.1:1209 ESTABLISHED 4
.....

And the TermService is running :

svchost.exe 2696 TermService

Originally Posted by biggles77

How are you trying to Remote into the Server? Internal or externally?

i'm on the same network as the Server (192.168.24.0/24). I tried aswell to use the rdp client locally on the server and connect on itself with the loopback address withtout success.

Originally Posted by biggles77

Have you tried using the latest RDP Client?

I'm using the version 6.0

Originally Posted by biggles77

Do you have a Firewall installed with your anti-virus?

No firewall are running on the server

Originally Posted by biggles77

Can you ping the Server from a client on the same IP Range?

I can ping it, access the registery, log event, ... remotly

Originally Posted by biggles77

Have you checked the settings in the RDP Client? Anything set that would stop a connection being made?

I'm not using any special setting on the client side. I can connect on the other server on the network.

Originally Posted by biggles77

Have you logged on locally to the Server? This is a known problem when SP2 is installed but physically logging onto the Server seemed to fix it.

I already log locally/reboot many time since the problem appear.
I still stuck ...　And now i'm really running out of idea

[Siolor]

Some more info that could maybe help somebody to help me

C:\Documents and Settings\Administrator>telnet 192.168.24.100 3389
Connecting To 192.168.24.100...Could not open connection to the host, on port 3389: Connect failed

C:\Documents and Settings\Administrator>telnet 192.168.24.100 10000
Connecting To 192.168.24.100...Could not open connection to the host, on port 10000: Connect failed

C:\Documents and Settings\Administrator>telnet 192.168.24.100 80

HTTP/1.1 400 Bad Request
Content-Type: text/html
Date: Fri, 30 Oct 2009 00:28:42 GMT
Connection: close
Content-Length: 35

<h1>Bad Request (Invalid Verb)</h1>

Connection to host lost.

C:\Documents and Settings\Administrator>

So as you can see, i can't connect on the port 3389 or 10000 that i set before. But i can make a tcp connection on the port 80 without any issue.

[joeqwerty]

Try to telnet to port 3389 of the TS and then at the same time on the TS server run:

netstat -a -b -n >c:\netstat.tx

from a command prompt. This will create a file in the root of the C drive with the netstat output. Check this file for the connection attempt from the telnet client.

[Siolor]

I'm now sure at 200% that the port is not open on the Server. Just done a PortQry. small tools include in the support tools.

portqry -local -l log.txt -y -v

Result for the server with the TS issue :

Process ID: 2696 (svchost.exe)

Service Name: TermService
Display Name: Terminal Services
Service Type: shares a process with other services


Port Statistics

TCP mappings: 0
UDP mappings: 0


Loaded modules:
C:\WINDOWS\System32\svchost.exe (0x01000000)

C:\WINDOWS\system32\ntdll.dll (0x7C950000)
C:\WINDOWS\system32\kernel32.dll (0x7C800000)
C:\WINDOWS\system32\ADVAPI32.dll (0x77DE0000)
C:\WINDOWS\system32\RPCRT4.dll (0x77BF0000)
C:\WINDOWS\system32\Secur32.dll (0x76E60000)
C:\WINDOWS\System32\NTMARTA.DLL (0x77FD0000)
C:\WINDOWS\system32\msvcrt.dll (0x77B40000)
C:\WINDOWS\system32\USER32.dll (0x77E90000)
C:\WINDOWS\system32\GDI32.dll (0x77BA0000)
C:\WINDOWS\system32\WLDAP32.dll (0x76E20000)
C:\WINDOWS\System32\SAMLIB.dll (0x7E020000)
C:\WINDOWS\system32\ole32.dll (0x77430000)
C:\WINDOWS\system32\IMM32.DLL (0x76120000)
C:\WINDOWS\System32\LPK.DLL (0x7F000000)
C:\WINDOWS\System32\USP10.dll (0x75220000)
C:\WINDOWS\System32\xpsp2res.dll (0x006F0000)
c:\windows\system32\termsrv.dll (0x76420000)
c:\windows\system32\ICAAPI.dll (0x74C60000)
c:\windows\system32\WS2_32.dll (0x71AA0000)
c:\windows\system32\WS2HELP.dll (0x71A90000)
C:\WINDOWS\system32\OLEAUT32.dll (0x77570000)
c:\windows\system32\AUTHZ.dll (0x76B50000)
c:\windows\system32\mstlsapi.dll (0x74E30000)
c:\windows\system32\ACTIVEDS.dll (0x76D00000)
c:\windows\system32\adsldpc.dll (0x76CD0000)
c:\windows\system32\NETAPI32.dll (0x71AE0000)
c:\windows\system32\credui.dll (0x76A70000)
C:\WINDOWS\system32\SHELL32.dll (0x7CA30000)
C:\WINDOWS\system32\SHLWAPI.dll (0x773D0000)
c:\windows\system32\ATL.DLL (0x76970000)
c:\windows\system32\CRYPT32.dll (0x76040000)
c:\windows\system32\MSASN1.dll (0x76020000)
c:\windows\system32\REGAPI.dll (0x77DB0000)
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.3790.3959_x-ww_D8713E55\comctl32.dll (0x77CA0000)
C:\WINDOWS\System32\rsaenh.dll (0x68000000)
C:\WINDOWS\System32\PSAPI.DLL (0x76A60000)
C:\WINDOWS\system32\VERSION.dll (0x77B30000)
C:\WINDOWS\System32\USERENV.dll (0x75810000)
C:\WINDOWS\system32\imagehlp.dll (0x76B20000)
C:\WINDOWS\System32\rdpwsx.dll (0x724C0000)
C:\WINDOWS\System32\WINSPOOL.DRV (0x72EC0000)
C:\WINDOWS\system32\kerberos.dll (0x71B40000)
C:\WINDOWS\System32\cryptdll.dll (0x765D0000)
C:\WINDOWS\system32\msv1_0.dll (0x76BA0000)
C:\WINDOWS\System32\iphlpapi.dll (0x76C00000)

Result on another server where the TS is working fine :

Process ID: 2064 (svchost.exe)

Service Name: TermService
Display Name: Terminal Services
Service Type: shares a process with other services

PID Port Local IP State Remote IP:Port
2064 TCP 3389 0.0.0.0 LISTENING 0.0.0.0:43073

Port Statistics

TCP mappings: 1
UDP mappings: 0

TCP ports in a LISTENING state: 1 = 100.00%

Loaded modules:
C:\WINDOWS\System32\svchost.exe (0x01000000)

C:\WINDOWS\system32\ntdll.dll (0x7C800000)
C:\WINDOWS\system32\kernel32.dll (0x77E40000)
C:\WINDOWS\system32\ADVAPI32.dll (0x7D1E0000)
C:\WINDOWS\system32\RPCRT4.dll (0x77C50000)
C:\WINDOWS\system32\Secur32.dll (0x76F50000)
C:\WINDOWS\System32\NTMARTA.DLL (0x77E00000)
C:\WINDOWS\system32\msvcrt.dll (0x77BA0000)
C:\WINDOWS\system32\USER32.dll (0x77380000)
C:\WINDOWS\system32\GDI32.dll (0x77C00000)
C:\WINDOWS\system32\WLDAP32.dll (0x76F10000)
C:\WINDOWS\System32\SAMLIB.dll (0x7E020000)
C:\WINDOWS\system32\ole32.dll (0x77670000)
C:\WINDOWS\system32\IMM32.DLL (0x76290000)
C:\WINDOWS\System32\LPK.DLL (0x7F000000)
C:\WINDOWS\System32\USP10.dll (0x75490000)
C:\WINDOWS\System32\xpsp2res.dll (0x006A0000)
c:\windows\system32\termsrv.dll (0x76540000)
c:\windows\system32\ICAAPI.dll (0x74D90000)
c:\windows\system32\WS2_32.dll (0x71C00000)
c:\windows\system32\WS2HELP.dll (0x71BF0000)
C:\WINDOWS\system32\OLEAUT32.dll (0x77D00000)
c:\windows\system32\AUTHZ.dll (0x76C40000)
c:\windows\system32\mstlsapi.dll (0x74F60000)
c:\windows\system32\ACTIVEDS.dll (0x76DF0000)
c:\windows\system32\adsldpc.dll (0x76DC0000)
c:\windows\system32\NETAPI32.dll (0x71C40000)
c:\windows\system32\credui.dll (0x76B80000)
C:\WINDOWS\system32\SHELL32.dll (0x7C8D0000)
C:\WINDOWS\system32\SHLWAPI.dll (0x77DA0000)
c:\windows\system32\ATL.DLL (0x76A80000)
c:\windows\system32\CRYPT32.dll (0x761B0000)
c:\windows\system32\MSASN1.dll (0x76190000)
c:\windows\system32\REGAPI.dll (0x77910000)
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.3790.3959_x-ww_D8713E55\comctl32.dll (0x77420000)
C:\WINDOWS\System32\rsaenh.dll (0x68000000)
C:\WINDOWS\System32\PSAPI.DLL (0x76B70000)
C:\WINDOWS\system32\VERSION.dll (0x77B90000)
C:\WINDOWS\System32\USERENV.dll (0x76920000)
C:\WINDOWS\system32\imagehlp.dll (0x76C10000)
C:\WINDOWS\System32\rdpwsx.dll (0x724C0000)
C:\WINDOWS\System32\WINSPOOL.DRV (0x73070000)

As we can notice there is no port open for the TS process.
But i notice one some difference in the result (the both server are full updated).
On the server with the issue, some more dll are loaded (bold one) for this specific service.
So, i'm now going to look little more about those dll and see if i can find some reason for it ...

edit : so, nothing special about those dll ... and i checked the version of all the dll and there are the same for both server .... (slowly getting annoy by this server )

[Siolor]

Couldn't find anything to fix the problem.
Going to use to go on the server console when I really need it.
I can keep doing most of the administration task remotely. So this server going to wait for his death without RDP.