Home
  •  

Connection Request Management

Microsoft.Windows.Server.RemoteDesktopServices.2012.NewUnitMonitor (UnitMonitor)

This object monitors connection requests received by the RD Connection Broker server.

Knowledge Base article:

Summary

Connection requests in RD Connection Broker include user connection requests and redirection connection requests.

Resolutions

To resolve this issue, check the event ID, and then view the troubleshooting information for that event in the sections below.

Resolution steps for the following event IDs: 802, 1280, 1281

To determine how to fix this error condition, examine the error code report in the event message text.

The event message can report the following error codes:

To perform these procedures, you must be a member of the Administrators group, or you must have been delegated the appropriate authority.

E_SB_SERVICE_STOPPING (0x88130019)

This error code indicates that the Remote Desktop Connection Broker service is stopping. If you requested that the Remote Desktop Connection Broker service stop, no user action is required. If the Remote Desktop Connection Broker service is stopped for an unknown reason, you must start the Remote Desktop Connection Broker service.

To start the Remote Desktop Connection Broker service:

1. On the RD Connection Broker server, open the Services snap-in. To open the Services snap-in, click Start, point to Administrative Tools, and then click Services.

2. Right-click Remote Desktop Connection Broker, point to All Tasks, and then click Start.

E_SB_TSV_URL_NOT_PRESENT (0x8813001F)

This error code indicates that the LoadBalanceInfo value in the RDP file is not correct.

The LoadBalanceInfo value in the RDP file contains the provider name, endpoint type, and an endpoint. The format of the LoadBalanceInfo value is in the form of LoadBalanceInfo:s:tsv://<provider>.<endpoint type>.<endpoint> where the following is true:

Some examples of properly formatted LoadBalanceInfo values are as follows:

E_SB_WRONG_TSV_URL_FORMAT (0x8813001C)

This error code indicates that the LoadBalanceInfo value in the RDP file is not correct.

The LoadBalanceInfo value in the RDP file contains the provider name, endpoint type, and an endpoint. The format of the LoadBalanceInfo value is in the form of LoadBalanceInfo:s:tsv://<provider>.<endpoint type>.<endpoint> where the following is true:

Some examples of properly formatted LoadBalanceInfo values are as follows:

E_SB_UNIDENTIFIED_TARGET_TYPE (0x8813001D)

This error code indicates that the endpoint type in the LoadBalanceInfo value contained in the RDP file is not correct. The endpoint type must be either 1 or 2.

The LoadBalanceInfo value in the RDP file contains the provider name, endpoint type, and an endpoint. The format of the LoadBalanceInfo value is in the form of LoadBalanceInfo:s:tsv://<provider>.<endpoint type>.<endpoint> where the following is true:

Some examples of properly formatted LoadBalanceInfo values are as follows:

E_SB_UNKNOWN_RESOURCE_PLUGIN (0x88130020)

This error code indicates that the resource plug-in specified in the LoadBalanceInfo value contained in the RDP file is not correct. The resource plug-in is entered as the endpoint and must correspond to a resource plug-in that has registered on the RD Connection Broker server. The plug-in is registered in the following registry path: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tssdis\Parameters\Plugins\Resource.

The LoadBalanceInfo value in the RDP file contains the provider name, endpoint type, and an endpoint. The format of the LoadBalanceInfo value is in the form of LoadBalanceInfo:s:tsv://<provider>.<endpoint type>.<endpoint> where the following is true:

Some examples of properly formatted LoadBalanceInfo values are as follows:

E_SB_FARM_NOT_FOUND (0x88130018)

This error code indicates that the farm name specified in the LoadBalanceInfo value contained in the RDP file is not correct. The farm name is entered as the endpoint and must correspond to a farm name that exists within your organization.

The LoadBalanceInfo value in the RDP file contains the provider name, endpoint type, and an endpoint. The format of the LoadBalanceInfo value is in the form of LoadBalanceInfo:s:tsv://<provider>.<endpoint type>.<endpoint> where the following is true:

Some examples of properly formatted LoadBalanceInfo values are as follows:

E_SB_NULL_CP_PLUGIN (0x88130022)

This error code indicates that the resource plug-in specified in the LoadBalanceInfo value contained in the RDP file is not correct. The resource plug-in is entered as the endpoint and must correspond to a resource plug-in that has registered on the RD Connection Broker server. The plug-in is registered in the following registry path: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tssdis\Parameters\Plugins\Resource.

The LoadBalanceInfo value in the RDP file contains the provider name, endpoint type, and an endpoint. The format of the LoadBalanceInfo value is in the form of LoadBalanceInfo:s:tsv://<provider>.<endpoint type>.<endpoint> where the following is true:

Some examples of properly formatted LoadBalanceInfo values are as follows:

E_SB_UNKNOWN_CP_PLUGIN (0x88130021)

This error code indicates resource or filter plug-in is not enabled. You must enable the plug-in by using Registry Editor.

To enable a resource or filter plug-in by using Registry Editor:

1. On the RD Connection Broker server, open Registry Editor. To open Registry Editor, click Start, and then click Run.

2. Type regedit.exe and then press ENTER.

3. Navigate to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tssdis\Parameters\Plugins

4. If you need to enable a resource plug-in: click Resource, and then click the plug-in to be enabled, double-click IsEnabled, and in the Value data box, type 1 and then click OK.

5. If you need to enable a filter plug-in: click Filter, and then click the plug-in to be enabled, double-click IsEnabled, and in the Value data box, type 1 and then click OK.

E_SB_WRONG_USER_DATA_FROM_PUB_SERVICE (0x8813001E)

This error code indicates the personal virtual desktop could not be located. You must ensure that the personal virtual desktop is assigned correctly by using Active Directory Users and Computers.

Note: This procedure assumes that your Active Directory Domain Services functional level is set to Windows Server 2008 R2 or newer. This functional level is required to see the Personal Virtual Desktop tab in Active Directory Users and Computers.

To ensure that the personal virtual desktop is assigned correctly:

1. On the domain controller, open Active Directory Users and Computers. To open Active Directory Users and Computers, click Start, point to Administrative Tools, and then click Active Directory Users and Computers.

2. Navigate to the user account object where the personal virtual desktop is assigned.

3. Right-click the user account object, and then click Properties.

4. Click the Personal Virtual Desktop tab.

5. Ensure that the Assign a personal virtual desktop to this user check box is selected.

6. In the Computer Name box, ensure that the computer name is pointing to the correct personal virtual desktop.

7. If the personal virtual desktop is configured correctly, you should ensure that the virtual machine is not part of a farm.

E_SB_NO_RESOURCE_PLUGIN (0x88130012)

This error code indicates that the resource plug-in specified in the LoadBalanceInfo value contained in the RDP file is not correct. The resource plug-in is entered as the endpoint and must correspond to a resource plug-in that has registered on the RD Connection Broker server. The plug-in is registered in the following registry path: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tssdis\Parameters\Plugins\Resource.

The LoadBalanceInfo value in the RDP file contains the provider name, endpoint type, and an endpoint. The format of the LoadBalanceInfo value is in the form of LoadBalanceInfo:s:tsv://<provider>.<endpoint type>.<endpoint> where the following is true:

Some examples of properly formatted LoadBalanceInfo values are as follows:

E_SB_TARGET_IN_DIFFERENT_FARM (0x8813001A)

This error code indicates that the farm name specified in the LoadBalanceInfo value contained in the RDP file does not match the farm in which the server is joined. The farm name is entered as the endpoint and must correspond to a farm name that exists within your organization.

The LoadBalanceInfo value in the RDP file contains the provider name, endpoint type, and an endpoint. The format of the LoadBalanceInfo value is in the form of LoadBalanceInfo:s:tsv://<provider>.<endpoint type>.<endpoint> where the ollowing is true:

Some examples of properly formatted LoadBalanceInfo values are as follows:

E_SB_VM_WAKE_FAILED (0x88130016)

This error code indicates that the RD Connection Broker server could not wake the virtual machine. For more information about this error code, you should examine Event Viewer logs and search for the following event messages.

To open Event Viewer:

1. On the RD Virtualization Host server, click Start, point to Administrative Tools, and then click Event Viewer.

2. In the Event Viewer console tree, navigate to Application and Services Logs\Microsoft\Windows\Microsoft-Windows-TerminalServices-TSV-VmHostAgent, and then search for event ID 4869, Source Microsoft-Windows-TerminalServices-TSV-VmHostAgent.

E_SB_VM_BOOT_FAILED (0x88130017)

This error code indicates that the RD Connection Broker server could not start the virtual machine. For more information about this error code, you should examine Event Viewer logs and search for the following event messages.

To open Event Viewer:

1. On the RD Virtualization Host server, click Start, point to Administrative Tools, and then click Event Viewer.

2. In the Event Viewer console tree, navigate to Application and Services Logs\Microsoft\Windows\Microsoft-Windows-TerminalServices-TSV-VmHostAgent, and then search for event ID 12801, Source Microsoft-Windows-TerminalServices-TSV-VmHostAgent.

E_SB_NO_TARGET_IP_ADDRESS (0x88130014)

This error code indicates a non-Microsoft resource plug-in did not return a valid IP address when the virtual machine was being orchestrated. For further troubleshooting, you should contact the manufacturer of the non-Microsoft resource plug-in.

Resolution steps for the following event IDs: 1022

To resolve this issue, reconsider the use of multiple IP addresses for redirection on Windows Server 2008-based terminal servers or Windows Server 2008 R2-based Remote Desktop Session Host (RD Session Host) servers in RD Session Host server farms that are comprised of Windows Server 2003 terminal servers and either Windows Server 2008 terminal servers or Windows Server 2008 R2 RD Session Host servers.

A Windows Server 2003-based terminal server cannot redirect users to a Windows Server 2008-based terminal server or a Windows Server 2008 R2-based RD Session Host server that has more than one IP address configured for redirection, because Windows Server 2003-based terminal servers do not support multiple IP address redirections.

To perform this procedure, you must have membership in the local Administrators group, or you must have been delegated the appropriate authority.

To configure the IP address to use for redirection:

1. On the RD Session Host server, open Remote Desktop Session Host Configuration. To open Remote Desktop Session Host Configuration, click Start, point to Administrative Tools, point to Remote Desktop Services, and then click Remote Desktop Session Host Configuration.

2. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Yes.

3. Under RD Connection Broker, double-click Member of farm in RD Connection Broker.

4. On the RD Connection Broker tab, under Select IP addresses to be used for reconnection, select the check box next to the single IP address that you want to use.

5. Click OK to close the Properties dialog box.

Resolution steps for the following event IDs: 771

This issue is caused when a virtual desktop cannot be removed from the RD Connection Broker database. No user action is required as the virtual desktop will not try to remove itself from the RD Connection Broker database because it was already removed.

Resolution steps for the following event IDs: 899

The working directory for RD Connection Broker is configured by using Registry Editor.

To perform this procedure, you must have membership in the local Administrators group, or you must have been delegated the appropriate authority.

To change the RD Connection Broker working directory:

1. On the RD Connection Broker server, open Registry Editor. To open Registry Editor, click Start, click Run, type regedit.exe and then click OK.

2. Navigate to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tssdis\Parameters.

3. Double-click WorkingDirectory.

4. In the Value data box, enter the path for the RD Connection Broker working directory, and then click OK.

5. Close Registry Editor.

Resolution steps for the following event IDs 896

To resolve this issue, do one or both of the following:

To perform these tasks, refer to the following sections.

The RD Connection Broker log files are located in the %windir%\system32\tssesdir folder (where %windir% is the folder in which the operating system is installed, which is, by default, c:\windows).

Close any RD Connection Broker log files that are open

If you have any of the log files open, close the files and then start the Remote Desktop Connection Broker service. To start the Remote Desktop Connection Broker service, see the section titled "Start the Remote Desktop Connection Broker service."

Ensure that the RD Connection Broker log files are not set to read-only

If the log files are not open, or if the problem still occurs after you close the files, ensure that the log files are not set to read-only and then start the Remote Desktop Connection Broker service.

To perform this procedure, you must have membership in the local Administrators group, or you must have been delegated the appropriate authority.

To check the read-only attribute for the log files:

1. On the RD Connection Broker server, click Start, click Run, type %windir%\system32\tssesdir and then click OK.

2. For each file, do the following:

After you check the read-only attribute of each log file, start the Remote Desktop Connection Broker service.

Start the Remote Desktop Connection Broker service

To perform this procedure, you must have membership in the local Administrators group, or you must have been delegated the appropriate authority.

To start the Remote Desktop Connection Broker service:

1. On the RD Connection Broker server, open the Services console. To open the Services console, click Start, point to Administrative Tools, and then click Services.

2. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Yes.

3. In the Services pane, right-click Remote Desktop Connection Broker, and then click Start.

4. Confirm that the Status column for the Remote Desktop Connection Broker service displays Started.

Resolution Steps for the following event IDs: 1298, 1297

To resolve this issue, do the following:

To perform these procedures, you must be a member of the Administrators group, or you must have been delegated the appropriate authority.

Start the Virtual Machine Manager Remote Desktop Server service

The Virtual Machine Manager Remote Desktop Server service must be started for Virtual Machine Manager to interact with the RD Connection Broker server.

To start the Virtual Machine Manager Remote Desktop Server service:

1. On the Virtual Machine Manager server, open the Services console. To open the Services console, click Start, point to Administrative Tools, and then click Services.

2. If the Status column for the Virtual Machine Manager Remote Desktop Server service does not say Started, right-click Virtual Machine Manager Remote Desktop Server, point to All Tasks, and then click Start.

3. If the issue is still not resolved, use the procedure in the section named "Allow TCP 8101 through the Windows Firewall."

Allow TCP port 8101 through the Windows Firewall

Virtual Machine Manager uses TCP port 8101 to communicate with the RD Connection Broker server.

To allow TCP 8101 through the Windows Firewall:

1. On the Virtual Machine Manager server, open Windows Firewall. To open Windows Firewall, click Start, and then click Control Panel.

2. Click System and Security, and then click Windows Firewall.

3. Click Allow a program or feature through Windows Firewall.

4. Ensure that VMM RDV Server is listed. If VMM RDV Server is not listed, run the following command at an elevated command prompt: netsh advfirewall firewall add rule name ="VMM RDV Server" dir=in action=allow protocol=TCP localport=8101 profile=any and then press ENTER.

5. If the issue is still not resolved, use the procedure in the section named "Ensure that the virtual machine appears in Virtual Machine Manager."

Ensure that the virtual machine appears in Virtual Machine Manager

The virtual machine must appear in Virtual Machine Manager before it can be used with the RD Connection Broker server.

To ensure that the virtual machine appears in Virtual Machine Manager:

1. On the Virtual Machine Manager server, open the Virtual Machine Manager Administrator Console.

2. Click Virtual Machines.

3. Ensure that the virtual machine appears in the list.

4. If this issue is still not resolved, use the procedure in the section named "Ensure that the virtual machine is in an acceptable state."

Ensure that the virtual machine is in an acceptable state

Each virtual machine must be in an acceptable state so that the RD Connection Broker server can communicate with it. The acceptable states are Running, Saved, Stopped, or Stored.

To ensure that the virtual machine is in an acceptable state:

1. On the Virtual Machine Manager server, open the Virtual Machine Manager Administrator Console.

2. Click Virtual Machines.

3. Locate the appropriate virtual machine.

4. Ensure that Running, Saved, Stopped, or Stored is displayed in the Status column.

5. If this issue is still not resolved, use the procedure in the section named "Ensure that the virtual machine can be started."

Ensure that the virtual machine can be started

In a non-clustered Remote Desktop Services environment, the virtual machine must be able to start.

To ensure that the virtual machine can be started:

1. On the Virtual Machine Manager server, open the Virtual Machine Manager Administrator Console.

2. Click Virtual Machines.

3. Right-click the appropriate virtual machine, and then click Start.

4. If this issue is still not resolved, use the procedure in the section named "Add the RD Connection Broker computer account to the Administrator User Role.”

Add the RD Connection Broker computer account to the Administrator User Role

The RD Connection Broker computer account is added to the Administrator User role by using the Virtual Machine Manager Administrator console.

To add the RD Connection Broker computer account to the Administrator User Role:

1. On the Virtual Machine Manager server, open the Virtual Machine Manager Administrator Console.

2. Click Administration, and then click User Roles.

3. Right-click the Administrator User Role, and then click Properties.

4. Click the Members tab, and then click Add.

5. In the Select Users, Computers, or Groups dialog box in the Enter the object names to select box, type the name of the RD Connection Broker server, and then click OK.

6. Click OK to close the User Role Properties for Administrator dialog box.

7. If this issue is still not resolved, use the procedure in the section named "Ensure that the RD Connection Broker computer account is a delegated administrator to the host group.”

Ensure that the RD Connection Broker computer account is a delegated administrator to the host group

The RD Connection Broker computer account must be a delegated administrator to the host group. This is done by using Virtual Machine Manager Administrator Console.

To ensure that the RD Connection Broker computer account is a delegated administrator to the host group:

1. On the Virtual Machine Manager server, open the Virtual Machine Manager Administrator Console.

2. Click Administration, and then click Users Roles.

3. Ensure that the proper user role exists. If the user role does not exist, use the procedure named "Create a new user role" in this section.

You can create a new user role by using the Virtual Machine Manager Administrator Console.

To create a new user role:

1. On the Virtual Machine Manager server, open the Virtual Machine Manager Administrator Console.

2. Click Administration, and then click User Roles.

3. Click New user role.

4. In the User role name box, type a name for the user role.

5. In the User role profile box, click Delegated Administrator.

6. Click Next.

7. Under User role members, click Add to add a new user account.

8. In the Select Users, Computers, and Groups dialog box in the Enter the object names to select box, type the user account, and then click OK.

9. Click Next.

10. Select the check box next to the appropriate host group, and then click Next.

11. Click Create.

Resolution steps for the following event IDs: 945

This issue can be caused by a configuration error in the farm. Ensure that the farm configuration is correct and try again.

Resolution steps for the following event IDs: 804, 1282

To resolve this issue, do the following:

1. Start the RemoteApp and Desktop Connection Management service.

2. Ensure that the personal virtual desktop is assigned by using Active Directory Users and Computers.

3. Ensure that the virtual machine name is the same as the fully qualified domain name of the guest operating system.

To perform these procedures, you must be a member of the Administrators group, or you must have been delegated the appropriate authority.

Start the RemoteApp and Desktop Connection Management service

The RemoteApp and Desktop Connection Management service must be started on the RD Connection Broker server so that users can connect to their assigned personal virtual desktops.

To start the RemoteApp and Desktop Connection Management service:

1. On the RD Connection Broker server, start the Services console. To start the Services console, click Start, point to Administrative Tools, and then click Services.

2. Right-click RemoteApp and Desktop Connection Management, point to All Tasks, and then click Start.

3. If the service was already started, follow the steps in the section named "Ensure that the personal virtual desktop is assigned by using Active Directory Users and Computers.”

Ensure that the personal virtual desktop is assigned by using Active Directory Users and Computers

You can assign personal virtual desktops to users by using the user account properties dialog box in Active Directory Users and Computers.

Note: To see the Personal Virtual Desktop tab in the user account properties dialog box, the functional level of your domain must be at Windows Server 2008 R2. If your functional level is at Windows Server 2008, you cannot use Active Directory Users and Computers.

To ensure that the personal virtual desktop is assigned by using Active Directory Users and Computers:

1. On the domain controller, open Active Directory Users and Computers. To open Active Directory Users and Computers, click Start, point to Administrative Tools, and then click Active Directory Users and Computers.

2. Navigate to and then right-click the desired user account object, and then click Properties.

3. Click the Personal Virtual Desktop tab.

4. Ensure that the Assign a personal virtual desktop to this user check box is selected.

5. In the Computer Name box, ensure that the computer name matches the fully qualified domain name of the virtual machine assigned as the personal virtual desktop.

6. If the personal virtual desktop was already assigned, follow the steps in the section named "Ensure that the virtual machine name is the same as the fully qualified domain name of the guest operating system.”

Ensure that the virtual machine name is the same as the fully qualified domain name of the guest operating system

The fully qualified domain name of the personal virtual desktop must match the name of the virtual machine. You can change this name by using Hyper-V Manager.

To ensure that the virtual machine name is the same as the fully qualified domain name of the guest operating system:

1. On the RD Virtualization Host server, open Hyper-V Manager. To open Hyper-V Manager, click Start, point to Administrative Tools, and then click Hyper-V Manager.

2. Under Virtual Machines, right-click the virtual machine that is assigned as the personal virtual desktop, and then click Settings.

3. Under the Management heading, click Name.

4. In the You can edit the name of this virtual machine box, ensure that the name of virtual machine matches the fully qualified domain name of the personal virtual desktop.

Resolution steps for the following event IDs: 785, 770

This issue can occur because of an issue with a non-Microsoft plug-in. You must contact the manufacturer of the non-Microsoft plug-in.

Element properties:

TargetMicrosoft.Windows.Server.2012.RemoteDesktopServicesRole.Service.RDConnectionBroker
Parent MonitorSystem.Health.AvailabilityState
CategoryCustom
EnabledTrue
Alert GenerateTrue
Alert SeverityMatchMonitorHealth
Alert PriorityHigh
Alert Auto ResolveTrue
Monitor TypeMicrosoft.Windows.2SingleEventLogManualReset3StateMonitorType
RemotableTrue
AccessibilityPublic
Alert Message
Connection Request Management Alert
Event ID: {0} -- Description: {1}
RunAsDefault

Source Code:

<UnitMonitor ID="Microsoft.Windows.Server.RemoteDesktopServices.2012.NewUnitMonitor" Accessibility="Public" Enabled="true" Target="Microsoft.Windows.Server.2012.RemoteDesktopServicesRole.Service.RDConnectionBroker" ParentMonitorID="SystemHealth!System.Health.AvailabilityState" Remotable="true" Priority="Normal" TypeID="Windows!Microsoft.Windows.2SingleEventLogManualReset3StateMonitorType" ConfirmDelivery="true">

  <Category>Custom</Category>

  <AlertSettings AlertMessage="Microsoft.Windows.Server.RemoteDesktopServices.2012.NewUnitMonitor_AlertMessageResourceID">

    <AlertOnState>Warning</AlertOnState>

    <AutoResolve>true</AutoResolve>

    <AlertPriority>High</AlertPriority>

    <AlertSeverity>MatchMonitorHealth</AlertSeverity>

    <AlertParameters>

      <AlertParameter1>$Data/Context/EventDisplayNumber$</AlertParameter1>

      <AlertParameter2>$Data/Context/EventDescription$</AlertParameter2>

    </AlertParameters>

  </AlertSettings>

  <OperationalStates>

    <OperationalState ID="UIGeneratedOpStateIdec0fc78be74e48bcaf3dd1e1a0020ed1" MonitorTypeStateID="ManualResetEventRaised" HealthState="Success"/>

    <OperationalState ID="UIGeneratedOpStateId5705f43ac1ae40ecb18b52e05c73ebeb" MonitorTypeStateID="SecondEventRaised" HealthState="Warning"/>

    <OperationalState ID="UIGeneratedOpStateId26c86031da8d4fb8beb0cb502e87c54e" MonitorTypeStateID="FirstEventRaised" HealthState="Error"/>

  </OperationalStates>

  <Configuration>

    <FirstComputerName>$Target/Host/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</FirstComputerName>

    <FirstLogName>Microsoft-Windows-TerminalServices-SessionBroker/Operational</FirstLogName>

    <FirstExpression>

      <And>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="String">Channel</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="String">Microsoft-Windows-TerminalServices-SessionBroker/Operational</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

        <Expression>

          <Or>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

                </ValueExpression>

                <Operator>Equal</Operator>

                <ValueExpression>

                  <Value Type="UnsignedInteger">1298</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

                </ValueExpression>

                <Operator>Equal</Operator>

                <ValueExpression>

                  <Value Type="UnsignedInteger">1297</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

                </ValueExpression>

                <Operator>Equal</Operator>

                <ValueExpression>

                  <Value Type="UnsignedInteger">1281</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

                </ValueExpression>

                <Operator>Equal</Operator>

                <ValueExpression>

                  <Value Type="UnsignedInteger">1280</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

                </ValueExpression>

                <Operator>Equal</Operator>

                <ValueExpression>

                  <Value Type="UnsignedInteger">1282</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

                </ValueExpression>

                <Operator>Equal</Operator>

                <ValueExpression>

                  <Value Type="UnsignedInteger">945</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

                </ValueExpression>

                <Operator>Equal</Operator>

                <ValueExpression>

                  <Value Type="UnsignedInteger">785</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

                </ValueExpression>

                <Operator>Equal</Operator>

                <ValueExpression>

                  <Value Type="UnsignedInteger">770</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

                </ValueExpression>

                <Operator>Equal</Operator>

                <ValueExpression>

                  <Value Type="UnsignedInteger">771</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

                </ValueExpression>

                <Operator>Equal</Operator>

                <ValueExpression>

                  <Value Type="UnsignedInteger">802</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

          </Or>

        </Expression>

      </And>

    </FirstExpression>

    <SecondComputerName>$Target/Host/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</SecondComputerName>

    <SecondLogName>Microsoft-Windows-TerminalServices-SessionBroker/Operational</SecondLogName>

    <SecondExpression>

      <And>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="String">Channel</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="String">Microsoft-Windows-TerminalServices-SessionBroker/Operational</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

        <Expression>

          <Or>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

                </ValueExpression>

                <Operator>Equal</Operator>

                <ValueExpression>

                  <Value Type="UnsignedInteger">1022</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

                </ValueExpression>

                <Operator>Equal</Operator>

                <ValueExpression>

                  <Value Type="UnsignedInteger">804</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

                </ValueExpression>

                <Operator>Equal</Operator>

                <ValueExpression>

                  <Value Type="UnsignedInteger">896</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

                </ValueExpression>

                <Operator>Equal</Operator>

                <ValueExpression>

                  <Value Type="UnsignedInteger">899</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

          </Or>

        </Expression>

      </And>

    </SecondExpression>

  </Configuration>

</UnitMonitor>