2

In my Admin event log, I see the following errors:

The Terminal Server security layer detected an error in the protocol stream and has disconnected the client. Client IP: XXX.XXX.XXX.XXX

Sometimes I see IP's here that I don't believe should have access to my server. The server is 2008 R2, uses NLA and sits behind a robust network Firewall. I do NOT see any Security Events (either Successful or Failed) of these IP's authenticating, which leads me to believe they were not authenticated to begin with, but I am not positive. I also do not see any RDP\Terminal Logon or Disconnect events from these IPs.

How would I go about finding more information about these events after they've already happened?

1

This USUALLY happens during times of heavy traffic to the terminal server. The connection to the server gets corrupted as traffic becomes too heavy to handle. I had this happen with my users at a former job quite a bit and almost every time I would see one of these in the Event Viewer I could talk to the user with the IP in question and correlate it to the time when they got disconnected from their terminal session.

See this for a very detailed explanation.

Mostly, it's not of malicious intent, but there is always the chance that an attacker is trying to DoS certain aspects of your systems, including your terminal server; to what end or goal they would do this, I cannot say, other than the usual buffer overflow type objectives. Again, we could go on forever about potential objectives. Mostly I wouldn't be too concerned as this is a very common occurrence on RDS/Terminal servers for Microsoft.

I would, however, validate the IPs listed in the log and make sure they are authorized IPs that your private IP scheme allows for and that they were in fact from legit users on your network connected to the server.

You can also check the RDS/terminal server settings and see if there is a timeout set on sessions; there usually is a default one, so I'd look for that first.

  • Yes, I see sometimes that whitelisted IP's get this error during heavy traffic. I've been able to verify that the IP's in question shouldn't be connecting to this server, but I can't find anything else related to those IP's in the RDS & Terminal Logs. My firewall shows nothing from these IP's being blocked. I have already modified the session timeout, but I'm still curious if there is anywhere else I can pull data from, to correlate against these sessions\IPs. It seems strange to me that there are no other records of these IP's anywhere in Network, TS\RDP or Security Logs. – TaterJuice Feb 22 '16 at 20:40
  • 1
    So, I get that you're saying that these IPs in question shouldn't be connecting to the server, however I'm more concerned with the fact that you know what these IPs are. Have you performed a reverse lookup on them to ensure they match hosts on your network that you know and trust and are a part of your company's trusted assets? If they are, then we can deal with the issue of them not having access to connect, but if you don't even recognize the hosts on the other end of these IPs then you have a bigger, more severe (in my opinion) problem. If they shouldn't be connecting and are then... – Brad Bouchard Feb 22 '16 at 23:07
  • ... you more than likely have a case of misconfigured firewall rules or switch/router ACLs and I'd check there first. – Brad Bouchard Feb 22 '16 at 23:08
  • Sorry for the poorly worded comment, what I meant to say was that I'd be concerned if you didn't recognize the IPs in question; meaning you couldn't recognize the names on reverse lookups for IPs. Essentially just make sure that even if the IPs connecting to the server shouldn't be, that they are at least hostnames of known computers on or in your network. As far as the IPs go, it sounds like you're referring to public IPs by referring to them as US IPs. Am I wrong about that, or are they in fact public IPs? If that's the case it still doesn't change my answer, but I'd check firewalls etc. – Brad Bouchard Feb 23 '16 at 5:56
  • Understood, thank you. Yes, that is exactly what I am concerned of. This is a publicly available RDP server (I don't manage the network firewall, but can request information, and don't control all machines on the network but control all credentials, and server uses Network Level Auth). I'm thinking of monitoring netstat -a -o 24/7 just to catch the IPs somewhere else. I just don't see them anywhere else. – TaterJuice Feb 23 '16 at 7:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.