Event ID 1041 — Terminal Server Connections

Applies To: Windows Server 2008

Users can connect to a terminal server to run programs, save files, and use network resources on that server. When a user disconnects from a session, all processes running in the session, including applications, will continue to run on the terminal server.

The user logon mode on the terminal server can be configured to prevent new user sessions from being created on the terminal server. You might want to prevent new user sessions from being created on the terminal server when you are planning to take the terminal server offline for maintenance or to install new applications.

Event Details

Resolve

Establish a new connection to the terminal server

To resolve this issue, establish a new connection to the terminal server by using a Remote Desktop Protocol (RDP) client such as Remote Desktop Connection.

When a client computer tries to reestablish a remote session with the terminal server after a temporary network interruption, the client computer attempts to authenticate with the terminal server. If the information passed between the client computer and the terminal server to reestablish the connection has become corrupted, the client computer will not be able to reestablish the remote session.

The Remote Desktop Connection client will automatically try to reconnect the remote session with the terminal server if the Reconnect if connection is dropped check box is selected on the Experience tab of the Remote Desktop Connection client.

Important:  If there are numerous events in the event log indicating that user authentication failed, it is possible that a malicious attempt is being made to gain access to the terminal server.

To perform this procedure, you must have membership in the local Administrators group, or you must have been delegated the appropriate authority.

To check which users are connected to the terminal server:

1. On the terminal server, click Start, point to Administrative Tools, point to Terminal Services, and then click Terminal Services Manager.
2. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue.
3. On the Users tab, the users that are connected to the terminal server are listed. Ensure that there are no suspicious accounts listed.

Verify

To verify that connections to the terminal server are working properly, establish a remote session with the terminal server.

Related Management Information

Terminal Server Connections

Terminal Services