none
RDP suddenly stop working on Windows 7 SP1/ Port 3389 not Listening

    Question

  • Hello,
    I have a problem with RDS (Remote Desktop) on a Windows 7 SP1 machine. It worked fine upto last 2 months.
    Suddenly I got Error: The computer can’t connect to the remote computer.

    First I checked some settings:
    - RDP enabled (also tried to disable, reboot en then enable)
    - Registry: fEnableWinStation (1)
    - Firewall is disabled (Thro' Domain Group Policy - same for all machine in network)
    - "Remote Desktop" programe allowed on "Allow a program or feature through Windows Firewall" list
    - RDP / RDS services are running - 
    - HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\TerminalServer\WinStations\RDP-Tcp\PortNumber  : it's pointing to 3389.

     Problem:
    - RDP/RDS is not listening
    - netstat -an |find /i "listening" command: no listener on port 3389
      (rdp is configured to use the default port, 3389, try to change then port but that new port also not in the list)
    - qwinsta command : RDP-Tcp session no in the list
    - as per this forum http://social.technet.microsoft.com/Forums/en-US/winservergen/thread/66b17d87-3523-40bc-84b1-cf752487520c/ and many other forum talking about KB2667402 and KB2621440.
      I first uninstalled KB2667402 and KB2621440. Download V2 for KB2667402 install it back. restart machine. Run sfc /scannow.
    - As per http://support.microsoft.com/kb/2667402, check for Rdpcorekmts.dll and it is a different version than the one on the working workstation, rename and copy/replace it from the working workstation.


    Does someone know a solution besides reinstall the OS.
    Thanks in advance.


    Tej Shah

    Wednesday, September 26, 2012 5:40 PM

Answers

  • Hi All,

    I Resloved this RDP issue after work with Microsoft.

    Here is solution for them, who are facing problem to do RDP on their windows 7 with SP1 machine from any machine. Please follow the below mentions step and it will give you a remote access to you Windows 7 w/SP1 Machine. It's works 100% for me on many machine on my network. Hope it will help, who is in the same boat as I was.

    Below are the steps that need to perform when you run in to RDP problem.

    1. if the patches show installed

    Windows Server 2008 R2 for x64-based Systems and Windows Server 2008 R2 for x64-based Systems Service Pack 1*

    OR

    Windows 7 for x86 or x64 based Systems Service Pack 1*

    (KB2621440)

    Windows Server 2008 R2 for x64-based Systems and Windows Server 2008 R2 for x64-based Systems Service Pack 1*

    OR

    Windows 7 for x86 or x64 based Systems Service Pack 1*

    (KB2667402)

    please uninstall these patches and reboot your box.

    run sfc /scannow to confirm that theres no file level corruption

    ensure that rdpcorekmts.dll file exists and is SP1 version that is it 6.1.7601.xxxx

    2. Export following registry entry from working RDP machine and  Import to machine having RDP issue.

    HKEY_CLASSES_ROOT\CLSID\{18b726bb-6fe6-4fb9-9276-ed57ce7c7cb2}

    reboot the box. Post reboot ensure that 3389 is listening using  command netstat -a

    3. Import the following registry entries and try to RDP

    HKLM\SYSTEM\CurrentControlSet\Control\Video\{DEB039CC-B704-4F53-B43E-9DD4432FA2E9}

    HKLM\SYSTEM\CurrentControlSet\services\RDPDD

    Able to RDP fine.

    4. reinstall Windows Server 2008 R2 for x64-based Systems and Windows Server 2008 R2 for x64-based Systems Service Pack 1*

    OR

    Windows 7 for x86 or x64 based Systems Service Pack 1*

    (KB2621440)

    Windows Server 2008 R2 for x64-based Systems and Windows Server 2008 R2 for x64-based Systems Service Pack 1*

    OR

    Windows 7 for x86 or x64 based Systems Service Pack 1*

    (KB2667402)   -  

    reboot and verify that RDP is still working

    I hope this will help many people with same RDP problem. If this works for you as well then put comment to help others.

    Thanks,


    Tej Shah

    SYSTEM ADMINISTRATOR
    Tuesday, October 02, 2012 12:36 AM

All replies

  • Hi,

    Is there any related trace in Event Viewer?

    1. Run telnet from a command line to port 3389 to test the functionality of port 3389.

    telnet servername 3389

    Using Telnet to Test Port 3389 Functionality

    http://support.microsoft.com/kb/187628

    2. Go to the terminal services configuration, delete RDP-tcp listener and then restart server. After booting go again to the Terminal Services Configuration and create a new RDP listener, restart server.

    Try the methods in this KB article.

    http://support.microsoft.com/kb/258021


    Tracy Cai

    TechNet Community Support

    Friday, September 28, 2012 12:24 PM
  • Hi Tracy,

    Thanks for reply.

    First of all As I mention before, I have problem to Remote login on Windows 7 Ent. with SP1 from any machine.

    I can't find any releted trace in Event Viewer under Windows Logs. I found some only three (3) Informational events under Application and Service Logs --> Microsoft --> Windows --> TerminalService-RemoteConnectionManager --> Operational.

    Log Name:      Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational
    Source:        Microsoft-Windows-TerminalServices-RemoteConnectionManager
    Date:          9/27/2012 5:54:23 PM
    Event ID:      1136
    Task Category: None
    Level:         Information
    Keywords:     
    User:          SYSTEM
    Computer:      cetcomp34.actcosys.com
    Description:
    Terminal Server role is not installed.
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="Microsoft-Windows-TerminalServices-RemoteConnectionManager" Guid="{C76BAA63-AE81-421C-B425-340B4B24157F}" />
        <EventID>1136</EventID>
        <Version>0</Version>
        <Level>4</Level>
        <Task>0</Task>
        <Opcode>0</Opcode>
        <Keywords>0x1000000000000000</Keywords>
        <TimeCreated SystemTime="2012-09-27T21:54:23.482446100Z" />
        <EventRecordID>899</EventRecordID>
        <Correlation />
        <Execution ProcessID="916" ThreadID="3124" />
        <Channel>Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational</Channel>
        <Computer>cetcomp34.actcosys.com</Computer>
        <Security UserID="S-1-5-18" />
      </System>
      <EventData>
      </EventData>
    </Event>

    Log Name:      Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational
    Source:        Microsoft-Windows-TerminalServices-RemoteConnectionManager
    Date:          9/26/2012 4:15:32 PM
    Event ID:      1143
    Task Category: None
    Level:         Information
    Keywords:     
    User:          SYSTEM
    Computer:      cetcomp34.actcosys.com
    Description:
    The "Limit the size of the entire roaming user profile cache" Group Policy setting has been disabled.
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="Microsoft-Windows-TerminalServices-RemoteConnectionManager" Guid="{C76BAA63-AE81-421C-B425-340B4B24157F}" />
        <EventID>1143</EventID>
        <Version>0</Version>
        <Level>4</Level>
        <Task>0</Task>
        <Opcode>0</Opcode>
        <Keywords>0x1000000000000000</Keywords>
        <TimeCreated SystemTime="2012-09-26T20:15:32.622921600Z" />
        <EventRecordID>888</EventRecordID>
        <Correlation />
        <Execution ProcessID="904" ThreadID="3712" />
        <Channel>Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational</Channel>
        <Computer>cetcomp34.actcosys.com</Computer>
        <Security UserID="S-1-5-18" />
      </System>
      <EventData>
      </EventData>
    </Event>

    Log Name:      Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational
    Source:        Microsoft-Windows-TerminalServices-RemoteConnectionManager
    Date:          9/27/2012 6:31:33 PM
    Event ID:      1155
    Task Category: None
    Level:         Information
    Keywords:     
    User:          NETWORK SERVICE
    Computer:      cetcomp34.actcosys.com
    Description:
    The Remote Connection Manager selected Kernel mode RDP protocol stack.
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="Microsoft-Windows-TerminalServices-RemoteConnectionManager" Guid="{C76BAA63-AE81-421C-B425-340B4B24157F}" />
        <EventID>1155</EventID>
        <Version>0</Version>
        <Level>4</Level>
        <Task>0</Task>
        <Opcode>0</Opcode>
        <Keywords>0x1000000000000000</Keywords>
        <TimeCreated SystemTime="2012-09-27T22:31:33.063450600Z" />
        <EventRecordID>901</EventRecordID>
        <Correlation />
        <Execution ProcessID="1128" ThreadID="1144" />
        <Channel>Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational</Channel>
        <Computer>cetcomp34.actcosys.com</Computer>
        <Security UserID="S-1-5-20" />
      </System>
      <EventData>
      </EventData>
    </Event>

    I tried Telnet command also but it failed because as mention before it's 3389 port not listening on that machine. I got error "Connecting To cetcomp34...Could not open connection to the host, on port 3389: Connect failed".

    your second point is for windows server 2000 server and I have problem on Windows 7 Enterprise Edition with SP1 installed.

    Any more suggesion ??

    Thanks.


    Tej Shah

    Friday, September 28, 2012 1:38 PM
  • Hi All,

    I Resloved this RDP issue after work with Microsoft.

    Here is solution for them, who are facing problem to do RDP on their windows 7 with SP1 machine from any machine. Please follow the below mentions step and it will give you a remote access to you Windows 7 w/SP1 Machine. It's works 100% for me on many machine on my network. Hope it will help, who is in the same boat as I was.

    Below are the steps that need to perform when you run in to RDP problem.

    1. if the patches show installed

    Windows Server 2008 R2 for x64-based Systems and Windows Server 2008 R2 for x64-based Systems Service Pack 1*

    OR

    Windows 7 for x86 or x64 based Systems Service Pack 1*

    (KB2621440)

    Windows Server 2008 R2 for x64-based Systems and Windows Server 2008 R2 for x64-based Systems Service Pack 1*

    OR

    Windows 7 for x86 or x64 based Systems Service Pack 1*

    (KB2667402)

    please uninstall these patches and reboot your box.

    run sfc /scannow to confirm that theres no file level corruption

    ensure that rdpcorekmts.dll file exists and is SP1 version that is it 6.1.7601.xxxx

    2. Export following registry entry from working RDP machine and  Import to machine having RDP issue.

    HKEY_CLASSES_ROOT\CLSID\{18b726bb-6fe6-4fb9-9276-ed57ce7c7cb2}

    reboot the box. Post reboot ensure that 3389 is listening using  command netstat -a

    3. Import the following registry entries and try to RDP

    HKLM\SYSTEM\CurrentControlSet\Control\Video\{DEB039CC-B704-4F53-B43E-9DD4432FA2E9}

    HKLM\SYSTEM\CurrentControlSet\services\RDPDD

    Able to RDP fine.

    4. reinstall Windows Server 2008 R2 for x64-based Systems and Windows Server 2008 R2 for x64-based Systems Service Pack 1*

    OR

    Windows 7 for x86 or x64 based Systems Service Pack 1*

    (KB2621440)

    Windows Server 2008 R2 for x64-based Systems and Windows Server 2008 R2 for x64-based Systems Service Pack 1*

    OR

    Windows 7 for x86 or x64 based Systems Service Pack 1*

    (KB2667402)   -  

    reboot and verify that RDP is still working

    I hope this will help many people with same RDP problem. If this works for you as well then put comment to help others.

    Thanks,


    Tej Shah

    SYSTEM ADMINISTRATOR
    Tuesday, October 02, 2012 12:36 AM
  • Hello,

    I have a problem applying this fix. Replacing the registry key (as mentioned in step 2) failed, because
    the original registry key is blocked. ("run as administrator" won't work)

    Tnx

    Tuesday, October 02, 2012 10:48 AM
  • Hello,

    To make changes in Registory user must have a local administrator privileges. Try to login as a local admin or if you try with domain user then make that user member of local administrator group or domain user must be a member of  domain admins security group.

    Try this way and let me know it works for you or not.

    Thanks,


    Tej Shah


    Tuesday, October 02, 2012 1:59 PM
  • Hello,

    I know. I did use a local administrator account. The error message says: some registry keys 
    are in use by the system or an other process. 

    Which process??

    Tnx

    Tuesday, October 02, 2012 4:16 PM
  • Hello,

    you can try few things if you facing problem in step 2.

    1. Stop all Remote Desktop services ( mainly 3 services) from the list of services. Then try to replace registry which you export from another working machine. This process try to replace vaules for rdpcorekmts.dll which is for Remote Desktop serivce.

    2. You can restart your machine in safe mode and login as a local administrator and then try to replace the registory. May be it will allow you this way.

    If it not works then start Problem Step Recorder ( Start-> in search windows type Problem Step Recorder -> Click on "Record steps to reproduce a problem") do all the process again after start recording with this tool and regenerate same error and send me that file. I will check if I can find find the problem and give some solution for that.

    Thanks,


    Tej Shah

    Tuesday, October 02, 2012 4:59 PM
  • Hello,

    I already tried to perform the steps in Safe mode.
    Results problem step recorder: download

    Tnx

    Wednesday, October 03, 2012 8:49 AM
  • Hello,

    Thanks for sending me your steps. I just checked your recored steps. Sorry for late reply. I can't understand your language, so first I have to convert it all in English then go through all yours steps to find the problem. As per my understanding after translating in english, I think you were encounter below error.

    registry editor error, cannot import registry key because of permissions or the keys are open by the system

    If you are encountering the above errors, without a doubt you’ve encountered a protected registry key. You need to get full control on that registory key which you want to replace with your backup registory. Please check this post and follow step-by-step instruction to get full control on that Registory key.

    http://www.groovypost.com/howto/take-full-permissions-control-edit-protected-registry-keys/

    One more thing to make sure that when you on permissions tab  Include Inheritable Permissions from this Object's Parent check box is selected if not then select and apply.

    Once you fix this then try again my steps to fix your RDP issue. I hope this will fix your problem and will get relief from this pain.

    Best luck...

    Thanks,


    Tej Shah

    Thursday, October 04, 2012 2:27 AM
  • Hi Leon,

    Just to know that my last solution resolve your problem or not ? Reply if you need future help or leave comment to help other who has same problem.

    Thx,


    Tej Shah

    Tuesday, October 09, 2012 9:13 PM
  • Hi Tej Shah,

    Your solution worked! The listening pot was open again and RD worked, yes workED!

    I did follow every step except 4 reinstalling the two updates (I let WSUS do that for me).

    But after a while port 3389 was not listening anymore after WSUS installed the updates again?!

    Do I have to exclude the updates (KB2621440 and KB 2667402) form updating?!

    Thanks,  Jo

    Wednesday, October 24, 2012 3:09 PM
  • Hi Jo,

    It should work after you install that both updates. I preferd to install both updates because it's a RDP security updates. If you facing same problem again then try my solution with all step at same time. Make sure you restart your machine after uninstall both updates, go through step 1 to 4. restart you machine again before use. Check it must be listening on port 3389 after installing both updates back.

    If you having same problem back then disable that updates so it will not install in future.

    Thanks,


    Tej Shah

    Wednesday, October 24, 2012 3:46 PM
  • Hi Tej Shah,

    Thank you for you quick response I’m going to follow all the steps now, and will not be lazy this time. I can test it I a couple of days, than I’m in the office with the customer again! Normally I can do it right away, with RD J.

    And I just wonder, what is going wrong I’ve got dozens of about the same Pc’s on similar networks, and only this PC is having the problems, could it be combination of software he’s running ((apple i-tunes) whispering)?  

    Thanks ..Jo

    Wednesday, October 24, 2012 4:01 PM
  • Hi Tej Shah,

    Today I solved the RD problem again!

    Short version:

    1 Removed KB2667402 and KB2667402 and reboot(after that port 3389 is listening again)

    2 Replaced rdpcorekmts.dll Version 6.1.7600.16952 with version 6.1.7601.17828.

    3 Installed KB2667402 and KB2667402 and reboot(after that port 3389 is still listening)

    4 rebooted another couple of times an tested RD form another machine, works well.

    The long version.

    1 sfc /scannow said (translated from Dutch) there are damaged files witch cannot be repaired all.

    2 I couldn’t import HKEY_CLASSES_ROOT\CLSID\{18b726bb-6fe6-4fb9-9276-ed57ce7c7cb2}

    Because the key was in use, I tried everything stop the services as a domain admin, as a local admin, save mode.. then I gave up.

    3 The same issue with the other two keys..

    Regards.. Jo

    Friday, October 26, 2012 3:19 PM
  • Hi Jo,

    If it reslove your problem then it's good to hear you.

    If you facing problem while replace Registery key then check my reply on Thursday, October 04, 2012 2:27 AM and try as per that. It should work for you.

    Thx


    Tej Shah

    Friday, October 26, 2012 4:49 PM
  • Hi Tej Shah,

    Monday the problem was back again!

    I solved the RD problem again and now step by step according to your advice!

    Tuesday the problem was back again!

    Then I removed KB2667402 and KB2667402 from the computer and from WSUS, preventing the updates to be installed again!

    Now, today the port 3389 is still listening and RD is working fine!

    Is there any knowledge, of what courses the problem, now the Pc is running without the two security updates!

    Jo.

    Thursday, November 01, 2012 9:00 AM
  • Hi There,

    I had just executed the solution recommended by Tej Shah.
    Two Servers were affected on the same issue. Its been a week and no problems occured on the server after.

    Here's what I did on my end; a slight revision (shortcut of the solution)

    1 Backup Registry and Import the following registry entries from a working server

    HKEY_CLASSES_ROOT\CLSID\{18b726bb-6fe6-4fb9-9276-ed57ce7c7cb2}
    HKLM\SYSTEM\CurrentControlSet\services\RDPDD

    2 Unininstall the Server Patches as indicated
    KB2621440 and KB2667402 

    3 Restart Server

    4 Check ports running via command line using netstat -a
      **see if 3389 port is already listening

    5 Reinstall Patches (KB2621440 and KB2667402) and Restart

    6 Check port 3389 if still listening and RDP the machine concerned.

    Hope that the same solution works.
    It was effective on our part. Thanks Tej Shah!

    pau dc

    Monday, November 12, 2012 3:43 AM
  • Hi Tej Shah

    Works like a charm!

    It was my headache for six months! In my case there was a strange behavior on 2008 R2 SP1. RDP connection was dropped at once as I input my credentials. But if I was already logged on locally, RDP connection established normally. After different manipulations with rdp files, installing/uninstalling patches RDP became down at all. Thanks Tej Shah I'm happy again!

    Tuesday, January 08, 2013 3:28 PM
  • Work, tnx!!!
    Wednesday, April 03, 2013 11:21 AM
  • For anyone who stumbles upon this later. I just had an employee with the same issue. However the resolution was a little different. Windows 7x64 SP1

    1. Uninstall both the updates listed above if installed (KB2621440 & KB 2667402)
    2. Run sfc /scannow
    3. Export the registry keys from a working computer(same OS preferably) listed above and import them into broken machine. If you encounter errors because you don't have permission you must seize ownership of the subkeys before you can change any access rights! Include and overwrite inheritable permissions on the keys and subkeys.
    4. Copy C:\windows\system32\rdpcorekmts.dll from a working machine replace it on the broken. The version should match 6.1.7601.xxxx

    5. If you cannot overwrite or delete the rdpcorekmts.dll file even after changing ownership put the working file in a different location (such as c:\windows) Then change 

    HKEY_CLASSES_ROOT\CLSID\{18b726bb-6fe6-4fb9-9276-ed57ce7c7cb2}\InprocServer32\Default   HKEY_CLASSES_ROOT\CLSID\{18b726bb-6fe6-4fb9-9276-ed57ce7c7cb2}\ToolboxBitmap32

    to the location where you put the working rdpcorekmts.dll (ex: %SystemRoot%\rdpcorekmts.dll - %SystemRoot% = c:\windows or where base directory for windows is installed)

    DO NOT INSTALL THE UPDATES LISTED!!

    With either update or both installed, it would move,replace or somehow impact that rdpcorekmts.dll to not allow rdp to function properly. Basically we could connect as long a local user session was already logged in. However if no one was logged in then we couldn't even reach the computer as the service wasn't listening.

    Wednesday, April 03, 2013 5:08 PM
  • Not sure if the original author or anybody else is still monitoring this thread, but I have run into the exact same problem and NONE of the solutions outlined here have proven effective.

    The problem workstation is Windows 7 x64 SP1.  I have a functional workstation that is also Windows 7 x64 SP1.  Ran into the same permissions issues as everyone else when attempting to do the registry import, but that's a moot point because the registry entries are exactly the same between the two machines.  Line for line.

    The version of rdpcorekmts.dll was different, which didn't surprise me since the functional machine has the two updates installed and the non-functional one had them removed.  Did copy it over, per IT-MioSoft's suggestion, but not even this step makes RDP functional.  The services are running but there's no open TCP listening port.

    I am at a total loss here.  Have even explored other threads on different sites with different solutions for this problem, and none of them have proven effective either.

    I fear that a reformat is all that's left in my toolbox, but if there is anything left I haven't tried I'd love to know now, before I pull the trigger on a rebuild.

    Any and all suggestions are appreciated!


    Thursday, June 13, 2013 10:40 PM
  • Hello,

    Thanks for the post.

    This resolution has worked for me. thanks a lot.

    Regards,

    Mohan and Ravi.

    Friday, July 05, 2013 11:41 AM
  • Hello Timothy,

    I have had the same Problem with 2 Win7 x86 machines.

     

    I only imported the registry entry  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp] from working RDP system.

     

    After a reboot Rdp worked fine.

    Thursday, August 08, 2013 7:58 AM
  • MVP always like difficult ways ;) Just do:

    reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f

    Tuesday, December 31, 2013 4:16 PM
  • Experienced the same issue on an installation of Windows 7 Ultimate x64.

    Followed the steps all the way through step 4 (KB2667402 reinstall;) at this point, RDP broke again. My problem system also has an unrelated issue receiving updates directly from Microsoft Update and instead only receives them from our WSUS server, so it compounded the resolution.

    Was unable to copy a good version of rdpcorekmts.dll successfully due to some permissions. Did import all of the specified registry keys from a known good installation of Windows 7 Enterprise x64, still no joy.

    Eventually ended up uninstalling KB2667402 and reinstalling the "version 2" patch from microsoft.com; make sure "v2" is in the filename. Ran sfc /scannow again. Re-imported the registry keys from the known good Windows installation. This restored the proper version of rdpcorekmts.dll(6.1.7601.17514 in my case.) Finally, ran regsvr32 on both remotepg.dll and rdpcorekmts.dll and achieved success.

    Thanks to Tej Shah for the initial write up and IT-Miosoft for the additional information. Hope this helps anyone else still suffering from this issue.

    - James



    Tuesday, May 06, 2014 11:50 PM
  • I have this exact issue, BUT the image I deployed to this laptop already had SP1 installed.  Therefore, to the best of my knowledge, I cannot uninstall the service pack if I did not manually install it.  I would like to know if there is a workaround for this or if there is indeed a way to uninstall the pre-loaded service pack.  

    Is it absolutely necessary to uninstall the the service pack to resolve this RDP issue, or could I skip that step and be fine?

    Thursday, June 05, 2014 1:25 PM
  • Hi Tyler_K,

    If you read my first reply for this you will find this will work on Windows 7 with SP1. you don't need to uninstall SP1. you need to look for installed updates (KB2621440) and (KB2667402) and remove it from remove it. Please read again and follow the step.

    Hope this will help..


    Tej Shah

    Thursday, June 05, 2014 8:48 PM