Event ID 1001 — TS Gateway Server Connections

Applies To: Windows Server 2008

For remote clients to successfully connect to internal network resources (computers) through a Terminal Services Gateway (TS Gateway) server, clients must meet the conditions specified in at least one Terminal Services connection authorization policy (TS CAP) and Terminal Services resource authorization policy (TS RAP). TS CAPs specify who can connect to a TS Gateway server and the authentication method that must be used. TS RAPs specify the computers that clients can connect to through a TS Gateway server. Note that a limit can be set on the TS Gateway server to restrict the maximum number of simultaneous client connections.

Event Details

Resolve

Restart the TS Gateway server, and if needed, remove and reinstall the TS Gateway role service

To resolve this issue, restart the TS Gateway server. If the problem persists, try removing and reinstalling the TS Gateway role service.

The failure to determine the version of Windows that the computer is running might be caused by one of the following issues:

• There is a problem with the Application Programming Interface (API) that provides the Windows version number (the API timed out).
• There is a problem with a hotfix or other update that was applied to the TS Gateway server (for example, if a hotfix or other update is not a genuine Microsoft software update). For more information, see the Microsoft Genuine Software Web site (https://go.microsoft.com/fwlink/?LinkId=102293).

Remove the TS Gateway role service

To perform this procedure, you must have membership in the local Administrators group, or you must have been delegated the appropriate authority.

To remove the TS Gateway role service:

1. Open Server Manager. To open Server Manager, click Start, point to Administrative Tools, and then click Server Manager.
2. In the Server Manager console tree, click Roles. In the details pane, under Terminal Services\Role Services, click Remove Role Services.
3. In the Remove Role Services Wizard, on the Select Role Services page, clear theTS Gateway check box, and then click Next.
4. On the Confirm Removal Selections page, confirm that TS Gateway appears in the list of role services to be removed, and then click Remove.
5. On the Removal Results page, Terminal Services (not TS Gateway) will appear, indicating that a restart is pending. You must restart the server to finish removing the TS Gateway role service.
6. Click Close.
7. You will be prompted to choose whether you want to restart the server now or later. Click Yes to restart the server immediately. Click No to restart the server later.
8. After you restart the server, log on to the server by using the same user account that you used to log on to the server previously, when you began removing the TS Gateway role service.
9. The Resume Configuration Wizard will open and the removal of the TS Gateway role service will be completed.
10. On the Removal Results page, confirm that the removal succeeded for the TS Gateway role service.
11. Click Close.

Reinstall the TS Gateway role service

To perform this procedure, you must have membership in the local Administrators group, or you must have been delegated the appropriate authority.

Note: If the Terminal Services role is already installed, begin with the steps in the section "To reinstall the TS Gateway role service (if the Terminal Services role is already installed)."

To reinstall the TS Gateway role service (if the Terminal Services role is not already installed):

1. Open Server Manager. To open Server Manager, click Start, point to Administrative Tools, and then click Server Manager.
2. In Server Manager, under Roles Summary, click Add Roles.
3. In the Add Roles Wizard, if the Before You Begin page appears, click Next. This page will not appear if you have already installed other roles and you have selected the Skip this page by default check box.
4. On the Select Server Roles page, under Roles, select Terminal Services, and then click Next.
5. On the Terminal Services page, click Next.
6. On the Select Role Services page, select the TS Gateway check box.
7. If prompted to specify whether you want to install the additional role services required for TS Gateway, click Add Required Role Services.
8. On the Select Role Services page, click Next.
9. On the Choose a Server Authentication Certificate for SSL Encryption, select the choice for an SSL encryption certificate that is appropriate for your environment, and then click Next. If you select Choose an existing certificate for SSL encryption (recommended), you must first click the certificate that you want to use, and then click Next. For information about choosing an SSL certificate, see "Obtain a certificate for the TS Gateway server" in the TS Gateway Manager Help in the Windows Server 2008 Technical Library (https://go.microsoft.com/fwlink/?LinkId=102173).
10. On the Create Authorization Policies for TS Gateway page, specify whether you want to create authorization policies (a TS CAP and a TS RAP) during the TS Gateway role service installation process or later, and then click Next. If you select Later, see "Create a TS CAP" (https://go.microsoft.com/fwlink/?LinkId=102171) and "Create a TS RAP" (https://go.microsoft.com/fwlink/?LinkId=102170) in the TS Gateway Manager Help in the Windows Server 2008 Technical Library for instructions about how to create these policies. If you select Now, do the following:
    1. On the Select User Groups That Can Connect Through TS Gateway page, click Add to specify additional user groups. In the Select Groups dialog box, specify the user group location and name, and then click OK as needed to check the name and to close the Select Groups dialog box. To specify more than one user group, do either of the following: Type the name of each user group, separating the name of each group with a semi-colon; or add additional groups from different domains by repeating the first part of this step for each group.
    2. After you finish specifying additional user groups, on the Select User Groups That Can Connect Through TS Gateway page, click Next.
    3. On the Create a TS CAP for TS Gateway page, accept the default name for the TS CAP (TS_CAP_01) or specify a new name, select one or more supported Windows authentication methods, and then click Next.
    4. On the Create a TS RAP for TS Gateway page, accept the default name for the TS RAP (TS_RAP_01) or specify a new name, and then do one of the following: Specify whether to allow users to connect only to computers in one or more computer groups, and then specify the computer group; or specify that users can connect to any computer on the network.
    5. Click Next.
11. On the Network Policy and Access Services page (which appears if this role service is not already installed), review the summary information, and then click Next.
12. On the Select Role Services page, confirm that Network Policy Server is selected, and then click Next.
13. On the Web Server (IIS) page (which appears if this role service is not already installed), review the summary information, and then click Next.
14. On the Select Role Services page, accept the default selections for Web Server (IIS), and then click Next.
15. On the Confirm Installation Selections page, confirm that the following role services will be installed, if they have not been already installed: Terminal Services\TS Gateway, Network Policy and Access Services\Network Policy Server, Web Server (IIS), and RPC over HTTP Proxy.
16. Click Install.
17. On the Installation Progress page, installation progress will be noted. If any of these roles, role services, or features has already been installed, installation progress will be noted only for the new roles, role services, or features that are being installed.
18. On the Installation Results page, confirm that installation for these roles, role services, and features was successful, and then click Close.

To reinstall the TS Gateway role service (if the Terminal Services role is already installed):

1. Open Server Manager. To open Server Manager, click Start, point to Administrative Tools, and then click Server Manager.
2. Under Roles Summary, click Terminal Services.
3. Under Role Services, click Add Role Services.
4. On the Select Role Services page, select the TS Gateway check box, and then click Next.
5. If prompted to specify whether you want to install the additional role services required for TS Gateway , click Add Required Role Services. On the Select Role Services page, click Next.
6. Proceed to step 9 in the previous section, "To reinstall the TS Gateway role service (if the Terminal Services role is not already installed)," and then follow the rest of the steps in that section.

If these steps do not resolve the problem, contact Microsoft Customer Service and Support (CSS). For information about how to contact CSS, see Support Options from Microsoft Services (https://go.microsoft.com/fwlink/?LinkID=52267).

Verify

To verify that TS Gateway server connectivity is working, examine Event Viewer logs and search for the following event messages.

To perform this procedure, you do not need to have membership in the local Administrators group. Therefore, as a security best practice, consider performing this task as a user without administrative credentials.

To verify that TS Gateway server connectivity is working:

1. On the TS Gateway server, click Start, point to Administrative Tools, and then click Event Viewer.
2. In the Event Viewer console tree, navigate to Application and Services Logs\Microsoft\Windows\TerminalServices-Gateway, and then search for the following events:
   • Event ID 101, Source TerminalServices-Gateway: This event indicates that the Terminal Services Gateway service is running.
   • Event ID 200, Source TerminalServices-Gateway: This event indicates that the client connected to the TS Gateway server.
   • Event ID 302, Source TerminalServices-Gateway: This event indicates that the client connected to an internal network resource through the TS Gateway server.

Related Management Information

TS Gateway Server Connections

Terminal Services