Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 1013 Source: TermService

The terminal server has exceeded the maximum number of allowed connections.
This typically occurs when the server exceeds the number of registred licenses. In "Remote Administration" mode, only 2 concurrent, administrator-level logins are permitted.

We have also this event occuring when firewall restrictions prevented the client to connect to the server properly. The TCP handshake would be permited but not the actual connection on port 3389 (MS RDP). As a result, the server would remain "locked", waiting for the connection to establish. The Terminal Services Manager would not show any sessions as being active. The "quick and dirty" solution is to reboot the server and fix the firewall rules.
It is a good idea to have VNC installed as a backup for access. If you have, logon using VNC and use Administrative Tools\Terminal Sevices Manager to logoff the old sessions. See ME250991.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.