Have a 2 Server 2008 R2 Farm and yesterday users were kicked out. The only events in the Event Viewer I can see are:
Several of these: Application, Event ID 9009 The Desktop Window Manager has exited with code (0x40010004)
Application, Event ID 1530 Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.
DETAIL - 1 user registry handles leaked from \Registry\User\S-1-5-21-2050110440-397107511-3843834758-2173: Process 2900 (\Device\HarddiskVolume2\Windows\System32\winlogon.exe) has opened key \REGISTRY\USER\S-1-5-21-2050110440-397107511-3843834758-2173
Edited byCTS-TechThursday, February 16, 2012 6:03 PM
Please check if any antivirus software or firewall settings led to this issue. You can disable or uninstall the 3rd security software in the Windows Server 2008 to see whether same issue still exists.
Ensure you have installed all update in Windows Server 2008 R2, such as SP1. Please also apply the following KB to your RDS servers.
A computer that is running Windows Server 2008 R2 or Windows 7 stops responding randomly http://support.microsoft.com/kb/2265716
Updating NIC drivers, checking the switches, setting the speed of NIC's to auto in the Windows client PC. Then you can try again to see whether the same issue still exists.
Microsoft is conducting an online survey to understand your opinion of the Technet Web site. If you choose to participate, the online survey will be presented to you when you leave the Technet Web site.