Windows Server 2012 R2 Remote Desktop Services - RDP client gets black screen, System Event ID 4005, TerminalServices Event ID 36

[George Perkins1709160940]

RDP users (Citrix XenApp) are getting connections refused/dropped and a black screen. This is Citrix MCS spawned terminal services on Windows Server 2012 R2.

 

After extensive Internet search with these symptoms I am coming up empty. I reviewed EventTracker and related MicrosoftHelp but these recommendations do not seem to apply in this case or are too vague to be useful. Those articles suggest a server resource constraint (we do not see this, unless it was temporary and is no longer present when the system event occurs), registry corruption (this seems very unlikely, but even if true, how do we determine which registry hive or key is corrupt?) or a service that needs restarting (which service? we do not see any errors showing failed or stopped services).

 

On the server seeing these messages:

Log Name:      Microsoft-Windows-TerminalServices-LocalSessionManager/Operational
Source:        Microsoft-Windows-TerminalServices-LocalSessionManager
Date:          5/7/2019 12:08:15 PM
Event ID:      36
Task Category: None
Level:         Error
Keywords:      
User:          SYSTEM
Computer:      CTXIAHYP004.mydomain.com
Description:
An error occurred when transitioning from CsrConnected in response to EvCsrInitialized. (ErrorCode 0x80004005)

Log Name:      Application
Source:        Microsoft-Windows-Winlogon
Date:          5/7/2019 12:08:15 PM
Event ID:      4005
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      CTXIAHYP004.mydomain.com
Description:
The Windows logon process has unexpectedly terminated.

 

[George Perkins1709160940]

This was our solution.

 

Epic Systems recommends the HungAppTimeout registry hack. His link on the Userweb site is https://userweb.epic.com/Thread/61367 

 

Hive: HKEY_CURRENT_USER

Key Path: Control Panel\Desktop

Value Name: HungAppTimeout

Value Type: REG_SZ

Value data: 30000

 

The black screen is an emergent behavior from the combination of Citrix 7.15 and Windows Server 2012 R2 +. What happens is that if an application window becomes unresponsive (due to long load times or otherwise) Windows will wait a certain amount of time for that application to become responsive again before it “ghosts” the window. This is what Microsoft’s documentation is referring to when they say “a forced process end is attempted”. The default time interval that Windows will wait for is 5 seconds (5000 milliseconds) before ghosting the window, this is controlled by the HungAppTimeout registry value.

 

Due to the layers of windows within Epic Hyperspace, a ghosted session over Citrix will appear as a black screen. This is what we see happening right now when Hyperspace takes more than 5 seconds to load (whether it is a large report or otherwise).  Changing the HungAppTimeout value to 30 seconds will allow Hyperspace to load for at least 30 seconds before ghosting, which should be less disruptive to users who are not expecting a black screen.

 

[George Perkins1709160940]

See above solution.