mstsc.exe crashing on auto-reconnect

[billypylgrym]

I have several users connecting to our main office via Terminal Services Gateway.  One user specifically is having issues daily with APPCRASH errors on mstsc.exe.  

She is running Windows 7 64 bit, all updates installed.  Gateway is on a SBS 2008 server.  No other users are having this problem.

 

After running the crash dump, it seemed that the issue was upon auto-reconnect.  Doing some research, I found that her HKEY_Local_machine\ system\currentcontrolset\control\terminal server entry fDenyTSConnections Key was set to 1.  I changed to 0 with no effect.  

 

I'm not sure what the next steps to take are.  Can anybody analyze this dmp file better than I have done?

 

Application Log Event Detail:

 

Faulting application name: mstsc.exe, version: 6.3.9600.16415, time stamp: 0x524b5b3d

Faulting module name: mstscax.dll, version: 6.3.9600.16503, time stamp: 0x52c5f878

Exception code: 0xc0000005

Fault offset: 0x0000000000439b7a

Faulting process id: 0x10c8

Faulting application start time: 0x01cf8fc6ce6ffa2d

Faulting application path: C:\Windows\System32\mstsc.exe

Faulting module path: C:\Windows\System32\mstscax.dll

Report Id: 88b5f942-fbc6-11e3-8332-0023245c063b

 

Crash Dump Detail:

 

Microsoft ® Windows Debugger Version 6.12.0002.633 AMD64

Copyright © Microsoft Corporation. All rights reserved.

 

 

Loading Dump File [C:\Users\mforsyth\Desktop\mstsc.exe.4420.dmp]

User Mini Dump File with Full Memory: Only application data is available

 

Symbol search path is: SRV*C:\SYMBOLS*http://msdl.microsoft.com/download/symbols

Executable search path is: 

Windows 7 Version 7601 (Service Pack 1) MP (4 procs) Free x64

Product: WinNt, suite: SingleUserTS

Machine Name:

Debug session time: Wed Jun 25 14:54:37.000 2014 (UTC - 4:00)

System Uptime: 0 days 1:13:44.347

Process Uptime: 0 days 1:12:24.000

................................................................

...............................................

Loading unloaded module list

................................................................

This dump file has an exception of interest stored in it.

The stored exception information can be accessed via .ecxr.

(1144.138c): Access violation - code c0000005 (first/second chance not available)

ntdll!ZwWaitForMultipleObjects+0xa:

00000000`775f186a c3              ret

0:012> !analyze -v

*******************************************************************************

*                                                                             *

*                        Exception Analysis                                   *

*                                                                             *

*******************************************************************************

 

*** ERROR: Module load completed but symbols could not be loaded for mstsc.exe

GetPageUrlData failed, server returned HTTP status 404

URL requested: http://watson.microsoft.com/StageOne/mstsc_exe/6_3_9600_16415/524b5b3d/mstscax_dll/6_3_9600_16503/52c5f878/c0000005/00439b7a.htm?Retriage=1

 

FAULTING_IP: 

mstscax!CClientProxyTransport::SetErrorStatus+a

000007fe`e7e29b7a 4883b98007000000 cmp     qword ptr [rcx+780h],0

 

EXCEPTION_RECORD:  ffffffffffffffff -- (.exr 0xffffffffffffffff)

ExceptionAddress: 000007fee7e29b7a (mstscax!CClientProxyTransport::SetErrorStatus+0x000000000000000a)

   ExceptionCode: c0000005 (Access violation)

  ExceptionFlags: 00000000

NumberParameters: 2

   Parameter[0]: 0000000000000000

   Parameter[1]: 0000000000000780

Attempt to read from address 0000000000000780

 

DEFAULT_BUCKET_ID:  INVALID_POINTER_READ

 

PROCESS_NAME:  mstsc.exe

 

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

 

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

 

EXCEPTION_PARAMETER1:  0000000000000000

 

EXCEPTION_PARAMETER2:  0000000000000780

 

READ_ADDRESS:  0000000000000780 

 

FOLLOWUP_IP: 

mstscax!CClientProxyTransport::SetErrorStatus+a

000007fe`e7e29b7a 4883b98007000000 cmp     qword ptr [rcx+780h],0

 

MOD_LIST: <ANALYSIS/>

 

NTGLOBALFLAG:  0

 

APPLICATION_VERIFIER_FLAGS:  0

 

FAULTING_THREAD:  000000000000138c

 

PRIMARY_PROBLEM_CLASS:  INVALID_POINTER_READ

 

BUGCHECK_STR:  APPLICATION_FAULT_INVALID_POINTER_READ

 

LAST_CONTROL_TRANSFER:  from 000007fee7e29c46 to 000007fee7e29b7a

 

STACK_TEXT:  

00000000`0581fcb0 000007fe`e7e29c46 : 00000000`00000008 000007fe`e7bffd68 00000000`03e0c550 000007fe`e7e3169f : mstscax!CClientProxyTransport::SetErrorStatus+0xa

00000000`0581fcf0 000007fe`e7e2bf85 : 00000000`03e0c550 00000000`03e0c550 00000000`0581fe30 000007fe`e7e091cc : mstscax!CClientProxyTransport::GetErrorStatus+0x26

00000000`0581fd40 000007fe`e7ef3b69 : 000007fe`e7a0d150 00000000`30000055 00000000`00000000 00000000`03e0f138 : mstscax!CProxyClientSendPacket::OnComplete+0x75

00000000`0581fd80 000007fe`e7e07a6b : 00000000`03da4f48 00000000`800706bf 00000000`0581fe30 00000000`72ed6872 : mstscax!CAAAsyncSend::OnComplete+0x29

00000000`0581fdb0 000007fe`e7e184a4 : 00000000`00000000 00000000`0581fe30 00000000`00000000 00000000`00000000 : mstscax!CAARpcClientChannel::HandleIOCompletion+0x15b

00000000`0581fde0 00000000`773959ed : 00000000`30000055 00000000`03e0f138 00000000`03da4f48 00000000`00000000 : mstscax!CAagIO::AAGIoThreadFunc+0x100

00000000`0581fe50 00000000`775cc541 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : kernel32!BaseThreadInitThunk+0xd

00000000`0581fe80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!RtlUserThreadStart+0x1d

 

 

SYMBOL_STACK_INDEX:  0

 

SYMBOL_NAME:  mstscax!CClientProxyTransport::SetErrorStatus+a

 

FOLLOWUP_NAME:  MachineOwner

 

MODULE_NAME: mstscax

 

IMAGE_NAME:  mstscax.dll

 

DEBUG_FLR_IMAGE_TIMESTAMP:  52c5f878

 

STACK_COMMAND:  ~12s; .ecxr ; kb

 

FAILURE_BUCKET_ID:  INVALID_POINTER_READ_c0000005_mstscax.dll!CClientProxyTransport::SetErrorStatus

 

BUCKET_ID:  X64_APPLICATION_FAULT_INVALID_POINTER_READ_mstscax!CClientProxyTransport::SetErrorStatus+a

 

WATSON_STAGEONE_URL:  http://watson.microsoft.com/StageOne/mstsc_exe/6_3_9600_16415/524b5b3d/mstscax_dll/6_3_9600_16503/52c5f878/c0000005/00439b7a.htm?Retriage=1

 

Followup: MachineOwner

---------

 

 

 

[MagicAndre1981]

6.3.9600.16xxx tells me you don't have the large 8.1 Update installed. Make sure you have all updates installed and try if you still can repro this.

[Tripredacus]

Well, the crash dump (and the op) indicates the OS is Windows 7 SP1, but the binary for mstsc.exe identified is from Windows 8.0.

 

You might be able to get better help if you are able to make the actual .dmp file available for analyzation.

[MagicAndre1981]

ah, good point. Overlooked this. Maybe he uses the RDP8.1 Update on Win7.

[billypylgrym]

Here's a link to the .dmp file.  Thanks for your help.

 

https://www.dropbox.com/s/mo7m89t8mavxpct/mstsc.exe.4420.dmp

[Tripredacus]

You mention that you have tested on both Windows 7 and Windows 8... does it also crash on the Windows 8 client?

How did you install this version of MSTSC on the Windows 7 PC? Was it from this?

http://support.microsoft.com/kb/2592687

 

Cross-posted topics:

http://serverfault.com/questions/603722/mstsc-gateway-crashes-on-auto-reconnect

http://social.technet.microsoft.com/Forums/windowsserver/en-US/a2093854-c30b-4111-b6b0-658608c262be/mstsc-v63-gateway-crashes-on-auto-reconnect?forum=winserverTS

[MagicAndre1981]

In the dump I see this error message:

CTsProxyFuncTable::m_RpcFuncs.pfnI_RpcReceive returned 1727

Error 1727 can mean the following things:

C:\>err 1727# for decimal 1727 / hex 0x6bf  RPC_S_CALL_FAILED_DNE                                          winerror.h# The remote procedure call failed and did not execute.# for hex 0x1727 / decimal 5927  ERROR_CLUSTER_INVALID_IPV6_TUNNEL_NETWORK                      winerror.h# The cluster network is not valid for an IPv6 Tunnel# resource. Check the configuration of the IP Address# resource on which the IPv6 Tunnel resource depends.# as an HRESULT: Severity: SUCCESS (0), FACILITY_NULL (0x0), Code 0x6bf# for decimal 1727 / hex 0x6bf  RPC_S_CALL_FAILED_DNE                                          winerror.h# The remote procedure call failed and did not execute.# as an HRESULT: Severity: SUCCESS (0), FACILITY_NULL (0x0), Code 0x1727# for hex 0x1727 / decimal 5927  ERROR_CLUSTER_INVALID_IPV6_TUNNEL_NETWORK                      winerror.h# The cluster network is not valid for an IPv6 Tunnel# resource. Check the configuration of the IP Address# resource on which the IPv6 Tunnel resource depends.# 4 matches found for "1727"

Check if you have ipv6 or RPC issues (check the eventlog for details)

[submix8c]

Related (Windows 8)?

http://social.technet.microsoft.com/Forums/windows/en-US/9fd4d6d5-1adc-494d-a916-0032f3e08789/remote-desktop-client-on-windows-8-drop-connection

 

edit - finding an "update" when searching

"rdp 8" "ipv6" "windows 7"

here -

http://support.microsoft.com/kb/2923545

Please note that I've found "recommendations" to -not- use IPv6. (also )

(from stupid Experts Exchange)

...disable IPv6 and flush DNS of PC you will RDP from...

Edited June 27, 2014 by submix8c