A Windows Server 2008 terminal server stops listening on port 3389 when the server is under stress conditions

View products that this article applies to.

Symptoms

When you have more than 50 pending connections to a Windows Server 2008 terminal server, you notice the following symptoms:

All the new logon requests fail.
You receive the following error message on the client computer:
Server is not found in the network
The PortQry utility or the Telnet utility report the status of port 3389 as "Not Listening".

Note Clients that connect to a Windows Server 2008 terminal server use TCP port 3389 to communicate with the terminal server.

However, you do not notice any adverse symptoms on the terminal server. All existing sessions appear to work without interruption, as expected.

↑ Back to the top

Cause

This behavior occurs in one of the following scenarios:

The Windows Server 2008 terminal server assumes that it is under attack. In this scenario, the terminal server stops listening until the pending connection count goes down. You may find an event that indicates that the terminal server has stopped listening in the event log file.
The pending connections cause the terminal server to consume more memory. The excess memory use may cause the TCP component to drop request packets.

↑ Back to the top

Workaround

To work around this behavior, change the value of the MaxOutstandingConnections registry entry to a number that is larger than 50. To do this, follow these steps:

Click Start, click Run, type regedit, and then click OK.
Locate and then click the following registry subkey:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server
In the details pane, double-click MaxOutstandingConnections.
Enter a value that is larger than 50, and then click OK.
Exit Registry Editor.

↑ Back to the top

More information

You can safely ignore this behavior as long as the terminal server continues to work as usual and as long as the terminal server does not restart when the load is reduced.

↑ Back to the top