none
The RDP protocol component X.224 detected an error in the protocol stream and has disconnected the client. RRS feed

  • Question

  • I did quite a bit of online research prior to asking my own question, but none of  the solutions I've found online really pertain to the issue we're experiencing.  
    We have 2 Windows 7 Pro PCs in the office.  They are accessed via RDP from within the same network/location.  The systems that are accessing these 2 PCs are an XP Pro machine and a Mac.  The clients stay connected for randomly lengths of time (no longer than 1 hour) before the session goes black and disconnects them randomly.  When the disconnect occurs, it's not due to inactivity.  The user has to wait several minutes before they are able to reconnect.  
    On the Windows 7 PCs, Event Viewer gives:

    Event ID: 50  The RDP protocol component X.224 detected an error in the protocol stream and has disconnected the client.
    Event ID: 56  The Terminal Server security layer detected an error in the protocol stream and has disconnected the client. 

    I've seen suggestions of checking registry keys and a lot of suggestions regarding Windows Server and Terminal Server, but they don't apply to our situation.  Please let me know if more information is required.  Thank you!

    Wednesday, May 11, 2011 2:51 PM

Answers

  • Hi,

     

    Do you enable the IEEE 802.1x authentication?

     

    Regarding the issue, I suggest updating the network adapter driver manually on Windows 7 PCs. Also update the router's driver and firmware.

     

    If the issue persists, you could disable the TCP Offload. To do this,

     

    a.       Run the following commands on both the client and the server to disable NIC offloading.

     

    netsh int tcp set global chimney=disabled

    netsh int tcp set global rss=disabled

     

    b.      Modify the following registry key to disable netDMA on the client and the server.

     

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\EnableTCPA

     

    Note: If this registry entry does not exist, right-click Parameters, point to New, click DWORD Value, type EnableTCPA, and then press ENTER.

     

    Value: 0

     

    You can also refer to the following KB to troubleshoot the issue. Hope it helps.

     

    http://support.microsoft.com/kb/2477023

     

    Best Regards,

    Niki


    Please remember to click "Mark as Answer" on the post that helps you, and to click "Unmark as Answer" if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
    • Marked as answer by bcsheather Friday, May 20, 2011 2:30 PM
    Friday, May 13, 2011 8:51 AM
    Moderator

All replies

  • Hi,

     

    Do you enable the IEEE 802.1x authentication?

     

    Regarding the issue, I suggest updating the network adapter driver manually on Windows 7 PCs. Also update the router's driver and firmware.

     

    If the issue persists, you could disable the TCP Offload. To do this,

     

    a.       Run the following commands on both the client and the server to disable NIC offloading.

     

    netsh int tcp set global chimney=disabled

    netsh int tcp set global rss=disabled

     

    b.      Modify the following registry key to disable netDMA on the client and the server.

     

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\EnableTCPA

     

    Note: If this registry entry does not exist, right-click Parameters, point to New, click DWORD Value, type EnableTCPA, and then press ENTER.

     

    Value: 0

     

    You can also refer to the following KB to troubleshoot the issue. Hope it helps.

     

    http://support.microsoft.com/kb/2477023

     

    Best Regards,

    Niki


    Please remember to click "Mark as Answer" on the post that helps you, and to click "Unmark as Answer" if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
    • Marked as answer by bcsheather Friday, May 20, 2011 2:30 PM
    Friday, May 13, 2011 8:51 AM
    Moderator
  • Thank you Niki,

    I haven't had access to the PCs in question for the past few days.  Hopefully, I will be able to try your suggestions today and will report back!

    Heather

    Monday, May 16, 2011 12:10 PM
  • Thanks so much! Just changing those things on the "server" computer did the trick!  The users now stay connected without any issues!

     

    Heather

    Friday, May 20, 2011 2:31 PM
  • I now have the same problem (Event ID 56) and it only started after I started using 802.1x authentication.

    I see you asked about 802.1x authentication? Is there an issue with it that can be fixed?

    I have an additional problem in that, after the error occurs, the target machine's network connection is deauthenticated (i.e. the whole thing, not just RDP) and remains in that state, saying "Authentication failed" until I disable and re-enable the adapter to trigger the 802.1x authentication.

    I'm using Win 7 x64 as the target RDP machine (which uses 802.1x user authentication, not machine authentication). The source machine is not using 802.1x.

    Any clues?

    Thanks in advance

    • Edited by Mast Abo Thursday, September 29, 2011 4:59 PM
    Thursday, September 29, 2011 4:47 PM
  • did you find a solution to this?  I am having a similar issue.
    Friday, November 11, 2011 6:01 PM
  • The Issue I am having is the cleint logs into his windows xp pro computer via remote desktop from home, everything works frine..  (in the evening after work) then when he gets up in the morning and tries to log in around five he can not make a connection, he comes into work and tries to logon and gets an error about unable to re-create exsisting session and can not log in until we reboot. The reason I post this here is the only thing I get in my error logs is this..

    The RDP protocol component X.224 detected an error in the protocol stream and has disconnected the client.


    I understand that this is a windows 7 post but this is the only page that comes up on technet when i google the error above.
    • Edited by Donavin410 Monday, April 23, 2012 1:36 PM
    Monday, April 23, 2012 1:16 PM
  • After fighting this issue for 1/2 day, finally tried disabling all TCP offloading options and it worked. Go figure. It makes no sense. This was on a HP BL460c G1 with HP NIC teaming.
    Wednesday, October 16, 2013 1:14 PM
  • I am having a similar issue, not solved by the above proposals. From my CentOS (Linux) workstation I can successfully RDP to our Windows 2008 servers, and once logged into a server I can successfully RDP from there to a Windows7 workstation. However, I cannot directly RDP from the CentOS box to the Windows7 box.  On the CentOS box I get "ERROR: recv: Connection reset by peer". In the Windows7 logs I see the x.224 error.  It seems like it could be a permissions issue since I can successfully get from the CentOS box to the Windows7 box if I first RDP to a Windows 2008 server then RDP from there to the Windows7 box (all this from the CentOS box).  Please advise.
    Thursday, February 5, 2015 1:34 PM
  • I had such connection issue from ubuntu/remmina to a 2k8R2 server in a remote LAN where was another 2K3 server that I could connect without problem. Both used the same remote IP address.

    The 2 entries in remmina were:

    2k3 :hostname(/etc/hosts):port

    2K8 : ip:otherport

    Changing 2K8 entry to hostname:otherport, I had a popup about a new certificate, then I could connect.

    Saturday, April 8, 2017 1:20 PM