locked
Remote desktop event RRS feed

  • Вопрос

  • Hi,

    We having some issue with our Windows 2008 R2 remote desktop services, we have a server 2008 R2 ent SP1 that our customer use remote desktop to access this server and run some app on it, last time when I check the application logs I can see alot of these information logs:

    event 9003:

    The Desktop Window Manager was unable to start because a composited theme is not in use

    event 9009:

    The Desktop Window Manager has exited with code (0x40010004)

    Any idea why this get loged? customer dont use the /Admin to access the T.S server.

    Shahin


    Shahin

    7 июня 2012 г. 9:26

Ответы

  • Hi Shahin,

    Is the customer experiencing actual symptoms or are you simply curious why the events are being logged?

    In my experience these events are normal.  Logically the 9003 event makes sense if you are not using full Aero remoting (transparent window title bars, etc.) although I have seen it logged even with full Aero sessions.  The 9009 event is logged when dwm is shut down during session log off.  I do not think these events being logged are helpful in the vast majority of cases but at the same time they are not harmful as long as the log file max size is large enough.

    -TP

    • Помечено в качестве ответа Shahin 13 июня 2012 г. 10:08
    11 июня 2012 г. 10:03

Все ответы

  • Hi,

    Is this event log issue persisting?The issue may be caused by the crash of the explorer.exe. The explorer.exe is responsible for displaying the Windows desktop.

    If persisits,please check if any antivirus software or firewall settings led to this issue. You can disable or uninstall the 3rd security software in the Windows Server 2008 r2 to see whether same issue still exists.

    Ensure you have installed all update in Windows Server 2008 R2, such as SP1.

    Updating NIC drivers, checking the switches, setting the speed of NIC's to auto in the Windows client PC. Then you can try again to see whether the same issue still exists.

    If it is not working,please try to repair with Windows Server 2008 r2 DVD disc and then check if the issue will re-occur.


    Regards,

    Clarence


    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

    11 июня 2012 г. 6:41
  • Hi Clarence,

    Thanks for your replay,

    We had some explore crash on this server but this heppens only for one user, I did remove this user profile and create a new one and the explore does not crash any more.

    also this heppens on all of the server 2008 R2 servers that have as RDS on them, host servers or virtual ones, all of these servers are fully patch and have SP1, and except on server none of them has issue with crsh Explorer.

    btw what has NIC and switch etc... drivers has something to do with desktop manager? do I missing soemthing here?

    Thanks


    Shahin

    11 июня 2012 г. 7:21
  • Hi Shahin,

    Is the customer experiencing actual symptoms or are you simply curious why the events are being logged?

    In my experience these events are normal.  Logically the 9003 event makes sense if you are not using full Aero remoting (transparent window title bars, etc.) although I have seen it logged even with full Aero sessions.  The 9009 event is logged when dwm is shut down during session log off.  I do not think these events being logged are helpful in the vast majority of cases but at the same time they are not harmful as long as the log file max size is large enough.

    -TP

    • Помечено в качестве ответа Shahin 13 июня 2012 г. 10:08
    11 июня 2012 г. 10:03
  • Hi Tp,

    Thanks for your replay,

    I have to say that customer as far as I know dont experiencing any issue, and I was just curious we these events get logged on physical host a.w.a virtual ones.

    so you think I should just ignor them?

    Thanks


    Shahin

    11 июня 2012 г. 12:59
  • Hi Tp,

    Thanks for your replay,

    I have to say that customer as far as I know dont experiencing any issue, and I was just curious we these events get logged on physical host a.w.a virtual ones.

    so you think I should just ignor them?


    I agree with TP. If customer is not experiencing actual symptoms,just ignore it.

    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

    13 июня 2012 г. 6:19
  • I have a customer, server is 2008 R2, SP1 who is has the same errors in the event log. They *are* experiencing problems with frequent disconnects from the RDP session, without warning.

    Log Name: Application

    Source: Desktop Window Manager
    Date: 6/18/2012 3:21:47 PM
    Event ID: 9009
    Task Category: None
    Level: Information
    Keywords: Classic
    User: N/A
    Computer: xxx.com
    Description:
    The Desktop Window Manager has exited with code (0x40010004)

    Not sure if these 2 log events are related, but they occurred at the same approximate time.

    Log Name: System

    Source: LsaSrv
    Date: 6/18/2012 3:21:23 PM
    Event ID: 45058
    Task Category: Logon Cache
    Level: Information
    Keywords: Classic
    User: N/A
    Computer: xxx.com
    Description:
    A logon cache entry for user retail2@xxx.COM was the oldest entry and was removed. The timestamp of this entry was 6/18/2012 14:49:22.
    Event Xml:

    Log Name: System
    Source: Microsoft-Windows-Winlogon
    Date: 6/18/2012 3:21:47 PM
    Event ID: 7002
    Task Category: (1102)
    Level: Information
    Keywords:
    User: SYSTEM
    Computer: xxx.com
    Description:
    User Logoff Notification for Customer Experience Improvement Program
    Event Xml:


    --- Marlana Harrison, A+, Network+

    18 июня 2012 г. 20:21
  • I have been having the same issue for 6 months. I have tried everything from disabling the FW completely to hacking the registry to force my sessions to remain however long I want them to. Nothing is working but it is much better. Did anyone come up with a definitive solution to this problem? Or do I have to attempt all of the above and see what works?

    It isn't the error message that is annoying, it is not being able to connect remotely and when I do, the connection just disconnects at random for no reason (it is not a time out issue!).

    • Изменено aotwSue 26 июля 2013 г. 18:11 further explanation
    26 июля 2013 г. 18:08
  • I have been having the same issue for 6 months. I have tried everything from disabling the FW completely to hacking the registry to force my sessions to remain however long I want them to. Nothing is working but it is much better. Did anyone come up with a definitive solution to this problem? Or do I have to attempt all of the above and see what works?

    It isn't the error message that is annoying, it is not being able to connect remotely and when I do, the connection just disconnects at random for no reason (it is not a time out issue!).

       Did anyone come up with a resolution for this issue?   I am having the same issue with connections to two  Windows/2008 SP1 servers.   Getting random  RDP disconnects with this message in the event log:

    Log Name:      Application
    Source:        Desktop Window Manager
    Date:          11/21/2013 5:44:24 PM
    Event ID:      9009
    Task Category: None
    Level:         Information
    Keywords:      Classic
    User:          N/A
    Computer:      xxxxxx.com
    Description:
    The Desktop Window Manager has exited with code (0x40010004)
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="Desktop Window Manager" />
        <EventID Qualifiers="16384">9009</EventID>
        <Level>4</Level>
        <Task>0</Task>
        <Keywords>0x80000000000000</Keywords>
        <TimeCreated SystemTime="2013-11-21T22:44:24.000Z" />
        <EventRecordID>30975</EventRecordID>
        <Channel>Application</Channel>
        <Computer>computer.name.com</Computer>
        <Security />
      </System>
      <EventData>
        <Data>0x40010004</Data>
      </EventData>
    </Event>



    • Изменено WarenMA 25 ноября 2013 г. 21:10
    25 ноября 2013 г. 21:08
  • We are also experiencing the exact same behaviour. Has anyone come up with a solution?

    Our symptoms:

    User logs into a remoteapp

    Session seems to load and immediately disconnects

    Windows Event Viewer logs the same event as communicated in earlier posts:

    "The Desktop Window Manager has exited with code (0x40010004)"

    We believe at this stage that our errors are related to the corruption of our catroot2 JET database on the windows server.

    http://technet.microsoft.com/en-us/library/cc734083(v=ws.10).aspx

    We have followed the instructions in the link above but are still unable to connect remotely to the TS server using remoteapp.


    26 ноября 2013 г. 15:34
  • http://support.citrix.com/article/CTX127883

    13 ноября 2014 г. 10:37