Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net. The EventId.Net for Splunk Add-on assumes that Splunk is collecting information from Windows servers and workstation via the Splunk Universal Forwarder.
The terminal server has exceeded the maximum number of allowed connections.
|English: Request a translation of the event description in plain English.|
This typically occurs when the server exceeds the number of registred licenses. In "Remote Administration" mode, only 2 concurrent, administrator-level logins are permitted.
We have also this event occuring when firewall restrictions prevented the client to connect to the server properly. The TCP handshake would be permited but not the actual connection on port 3389 (MS RDP). As a result, the server would remain "locked", waiting for the connection to establish. The Terminal Services Manager would not show any sessions as being active. The "quick and dirty" solution is to reboot the server and fix the firewall rules.
It is a good idea to have VNC installed as a backup for access. If you have, logon using VNC and use Administrative Tools\Terminal Sevices Manager to logoff the old sessions. See ME250991.
|Private comment: Subscribers only. See example of private comment|
|Search: Google - Bing - Microsoft - Yahoo - EventID.Net Queue (0) - More links...|
Send comments or solutions
- Notify me when updated