Remote Access Server only intermittently accepting connections

[ithrbruce]

Hi,

I have a Windows Server 2008 remote access server that is suddenly only intermittently accepting connections. The same issue happens for external as well as internal users, and also if I specify its internal IP address as well as a DNS name.

A few days ago I installed Malwarebytes on it to see if there was anything that shouldn't be on there. I got it to delete two items that it had red-flagged, and then it restarted. Since then, whenever I or anyone else tries to connect to it, it can usually take up to five or sometimes more attempts to connect, when previously it always worked first time.

It's clear that for a few seconds at a time it accepts connections, and then it doesn't. There isn't anything in the logs that would indicate what has happened.

This only happened after I ran Malwarebytes, and has never happened before. So I really do not know what have caused this to happen.

If anyone has any ideas, it would be most appreciated.

Thank you.

 

[Neemobeer]

A few things.

• Look in Malwarebytes and see what it deleted, could be false positive items removed
• Look in Event Viewer at the Operational logs in TerminalServices-LocalSessionManager and TerminalServices-SessionBroker-Client
• Are there other sessions open and do you have enough RDS CALs?

 

[ithrbruce]

Thanks for the reply...
I uninstalled Malwarebytes after it restarted the server without much warning. I don't think the logs are there anymore.
I will check out those other logs.
Other sessions are open and running fine. I have also checked the CALs, we have plenty.
Thank you.

 

[ithrbruce]

The logs show nothing unfortunately. TerminalServices-LocalSessionManager only shows successful events, TerminalServices-SessionBroker-Client is totally empty.

When a connection fails, the error message indicates the server cannot be found, it says Remote Desktop can't connect to the remote computer for one of these reasons... Remote access not enabled, turned off, or not available on the network.

Thank you.

 

[ithrbruce]

I telnetted (sometimes not!) to the server and determined that port 3389 periodically accepts a connection and then doesn't. Need to find out what is causing that.

 

[ithrbruce]

The issue has now cleared ;-)

I contacted Malwarebytes via their forum and they suggested I run their diagnostic tool to collect logs to send to them, I did not run any fixes with it. However, after I ran the tool, the intermittent connectivity issue cleared. The tech at Malwarebytes said the logs did not contain any info as I had uninstalled the main program, but he could only speculate on how the tool cleared the problem, perhaps a cache was cleared out or some network blockage was removed.

So thanks to them as one way or another, their quick response helped immensely.