RDS black screens with Event ID 4005

Situation: When the client tries to RDS to remote into a server. he gets black screen until reboot the server. The event viewer also shows this error:

Winlogon terminated unexpectedly with Event ID 4005

Resolution: download and install Microsoft August 2016 update rollup for Windows 8.1 and Windows Server 2012 R2.

Quoted from Microsoft engineer:

We believe there is a problem in a code change we made to a file that is in both the July and August rollups - investigations are still under way. The symptoms are that the Remote Desktop Server service gets into a deadlock during virtual channel management and all new connections go no further than a black screen. Since the RDS service is deadlocked it cannot be restart or stopped. You can however kill the relevant SVCHOST.EXE process with Task Manager and manually start the RDS service to recover. Existing users can reconnect and new users can logon.

To find the RDS svchost, use Task Manager, Services tab to look for TermService. Right-click on it and choose Go To Details. This will highlight the svchost.exe in the Details tab. Right-click on that and choose Create Dump File (this is for confirmation and further investigation should you wish to have us review it), and then right-click again and choose End Task.
As above, we are investigating further, but unfortunately with complex issues like this there is no ETA. The workarounds are to uninstall July and August rollups, or manually End Task and restart the RDS service as above.

If you would like us to confirm that you are seeing this specific issue, then please raise a Service Request with Microsoft Support; providing us the dump file (when the issue is occurring) captured with the steps above.
We are planning to update the July and August rollup KBs to list this problem as a known issue. I believe some people report the issue persists after removing both rollups. If this applies to you can you please check that the date on the c:\windows\system32\rdpcorets.dll file pre-dates July 2016? If the file is dated July 2016 or later then you haven't rolled back all updates that contain the file - which at present should only be the July (KB3172614) and August (KB3179574) rollups. At the moment we are reasonably sure that the issue is within rdpcorets.dll.

Contact a consultant

Related Topics

Bob Lin Photography services

Real Estate Photography services