Home
  •  

Terminal Services failed to start or is not accepting any client connections

TS_failed_to_start_or_is_not_accepting_any_client_connections_2000 (Rule)

Knowledge Base article:

Summary

Terminal Server was unable to initialize a library, and failed to start. These problems are typically caused by insufficient memory.

This rule covers the following event IDs: 1014, 1015

Windows Server 2000 operating systems only: 1016, 1036

Causes

Possible causes include:

Event 1014: Terminal Server cannot load an illegal module.

Event 1015: The connection was disabled, and its custom network adapter settings reset, because the terminal server could not determine the desired adapter.

Event 1016 (Windows Server 2000 operating systems only): Terminal Server failed to load because it could not initialize the COM library. This is probably due to the terminal server being out of memory.

Event 1036 (Windows Server 2000 operating systems only): Terminal Server failed to create a session.

Resolutions

Possible resolutions include:

Event 1014:Verify that the module identified in the event message uses the correct signature.

When installing new software on your computer, system files and device driver files are sometimes overwritten by unsigned or incompatible versions, causing system instability. The system files and device driver files provided with Windows Server operating systems have a Microsoft digital signature, which indicates that the files are original, unaltered system files or that they have been approved by Microsoft for use with Windows. Using File Signature Verification, you can identify unsigned files on your computer and view the following information about them:

The file name

The file location

The file modification date

The file type

The file version number

To start File Signature Verification, click Start, click Run, type sigverif, and then click OK. If the module is one of the default Terminal Server modules (termdd.sys, tdtcp.sys, etc.) uninstalling and then reinstalling Terminal Services should solve this problem.

Event 1015:

Restart the computer.

Add more memory.

Enable the network connection and modify the network adapter settings by using the Terminal Services Configuration tool.

Event 1016 (Windows Server 2000 operating systems only):

Restart the computer.

Add more memory.

Enable the network connection and modify the network adapter settings by using the Terminal Services Configuration tool.

Event 1036 (Windows Server 2000 operating systems only):

Open the registry editor.

Caution Incorrectly editing the registry may severely damage your system. Before making changes to the registry, you should back up any valued data on the computer.

Change the value for HKLM\SYSTEM\CurrentControlset\Control\Terminal Server\Winstation\RDP-Tcp\PortNumber to 3389, or enter another unoccupied port number.

Save and close the registry editor.

Element properties:

TargetMicrosoft.Windows.Server.2000.TerminalServerRole
CategoryEventCollection
EnabledTrue
Event SourceTermService
Alert GenerateTrue
Alert SeverityWarning
Alert PriorityNormal
RemotableTrue
Alert Message
Terminal Services failed to start or is not accepting any client connections
{0}
Event LogSystem
CommentMom2005ID='{A788C91C-85D6-486A-AF7D-E320F8819846}'

Member Modules:

ID Module Type TypeId RunAs 
Event_Data_Source DataSource Microsoft.Windows.EventProvider Default
GenerateAlert WriteAction System.Health.GenerateAlert Default

Source Code:

<Rule ID="TS_failed_to_start_or_is_not_accepting_any_client_connections_2000" Target="Microsoft.Windows.Server.2000.TerminalServerRole" Enabled="onEssentialMonitoring" Remotable="true" Comment="Mom2005ID='{A788C91C-85D6-486A-AF7D-E320F8819846}'">

  <Category>EventCollection</Category>

  <DataSources>

    <DataSource ID="Event_Data_Source" TypeID="Windows!Microsoft.Windows.EventProvider">

      <ComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>

      <LogName>System</LogName>

      <Expression>

        <And>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery>PublisherName</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value>TermService</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

          <Expression>

            <RegExExpression>

              <ValueExpression>

                <XPathQuery>EventNumber</XPathQuery>

              </ValueExpression>

              <Operator>MatchesMOM2005RegularExpression</Operator>

              <Pattern>^(-1073740810|-2147482633)$</Pattern>

            </RegExExpression>

          </Expression>

        </And>

      </Expression>

    </DataSource>

  </DataSources>

  <WriteActions>

    <WriteAction ID="GenerateAlert" TypeID="SystemHealth!System.Health.GenerateAlert">

      <Priority>1</Priority>

      <Severity>1</Severity>

      <AlertOwner>$Data/PublisherName$</AlertOwner>

      <AlertMessageId>$MPElement[Name="TS_failed_to_start_or_is_not_accepting_any_client_connections_2000.AlertMessage"]$</AlertMessageId>

      <AlertParameters>

        <AlertParameter1>$Data/EventDescription$</AlertParameter1>

      </AlertParameters>

      <Suppression>

        <SuppressionValue/>

      </Suppression>

    </WriteAction>

  </WriteActions>

</Rule>