RDP логи подключений

1. Коды

eventid 40

reason code

I posted this over http://community.spiceworks.com/topic/550908-terminal-services-disconnections-reason-codes but may as well add it here to

Looks to me like the reason codes match up to these ones https://msdn.microsoft.com/en-us/library/windows/desktop/aa381339(v=vs.85).aspx

For quick reference here is a copy/paste of the table (with Hex converted to Decimal)

0 No additional information is available.
1 An application initiated the disconnection.
2 An application logged off the client.
3 The server has disconnected the client because the client has been idle for a period of time longer than the designated time-out period.
4 The server has disconnected the client because the client has exceeded the period designated for connection.
5 The client's connection was replaced by another connection.
6 No memory is available.
7 The server denied the connection.
8 The server denied the connection for security reasons.
9 The server denied the connection for security reasons.
10 Fresh credentials are required.
11 User activity has initiated the disconnect.
12 "The user logged off, disconnecting the session."
256 Internal licensing error.
257 No license server was available.
258 No valid software license was available.
259 The remote computer received a licensing message that was not valid.
260 The hardware ID does not match the one designated on the software license.
261 Client license error.
262 Network problems occurred during the licensing protocol.
263 The client ended the licensing protocol prematurely.
264 A licensing message was encrypted incorrectly.
265 The local computer's client access license could not be upgraded or renewed.
266 The remote computer is not licensed to accept remote connections.
267 An access denied error was received while creating a registry key for the license store.
768 Invalid credentials were encountered.

2. http://winitpro.ru/index.php/2018/09/25/analizing-rdp-logs-windows-terminal-rds/

3. https://ponderthebits.com/2018/02/windows-rdp-related-event-logs-identification-tracking-and-investigation/

4. https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/ff404144(v=ws.10)

MSSQL xp_cmdshell

SQL Server blocked access to procedure 'sys.xp_cmdshell' of component 'xp_cmdshell' because this component is turned off as part of the security configuration for this server. A system administrator can enable the use of 'xp_cmdshell' by using sp_configure. For more information about enabling 'xp_cmdshell', search for 'xp_cmdshell' in SQL Server Books Online.

https://www.daktronics.com/support/kb/Pages/DD3360274.aspx

pfsense

view nat tables
pfctl -ss

MSSQL AlwaysOn

http://pyatilistnik.org/gruppyi-dostupnosti-alwayson/


http://www.sql.ru/blogs/dbasimple/2011
https://docs.microsoft.com/ru-ru/sql/database-engine/database-mirroring/set-up-login-accounts-database-mirroring-always-on-availability?view=sql-server-2017
https://support.microsoft.com/ru-ru/help/918992/how-to-transfer-logins-and-passwords-between-instances-of-sql-server
http://dbasimple.blogspot.com/2013/05/ms-sql-server.html

ReadOnly

http://www.sqlservercentral.com/articles/always+on/167193/

pfsense команды

Просмотр таблицы NAT
pfctl -ss

RDS. Не удалось получить свойства коллекции сеансов

При добавлении сервера RDS в коллекцию, ошибка:

Не удалось получить свойства коллекции сеансов.
    + CategoryInfo          : InvalidResult: (:) [], RDManagementException
    + FullyQualifiedErrorId : JobStateFailed
    + PSComputerName        : localhost

На en

Unable to retrieve the session collection properties.
    + CategoryInfo          : InvalidResult: (:) [], RDManagementException
    + FullyQualifiedErrorId : JobStateFailed
    + PSComputerName        : localhost

Добавление через GUI либо Powershell
Add-RDSessionHost -SessionHost "rds8.noname.local" -CollectionName "Name_my_collection" -ConnectionBroker "broker01.noname.local"

Решение:

https://social.technet.microsoft.com/Forums/en-US/42d7f0d8-9770-4cbb-9c47-a4500fc93ab2/unable-to-retrieve-the-session-collection-properties?forum=winserverTS

https://onix.me/error-remoteapp-dont-get-properties-collection/

А именно:

Выполняем в PS

Import-Module С:\Windows\System32\ServerManagerInternal\RDManagement\RDManagement.psd1

и

Get-RDSHPool -Alias *

Выводится список все коллекций и их свойств. Проблемных коллекций может быть несколько, и вывод по ним будет красный. Для решения проблемы в проблемные коллекции нужно в свойства в "Настройка групп пользователей" добавить группы "Domain Admins". После того, как Get-RDSHPool -Alias * выполняется без ошибок можно добавить rds в коллекцию.

Import-Module Remote-Desktop

Add-RDSessionHost -SessionHost "rds8.noname.local" -CollectionName "Name_my_collection" -ConnectionBroker "broker01.noname.local"

И затем группу "Domain Admins" удаляем, так где добавили, ошибок больше не происходит.

RDP powershell

Полезные команды powershell для RDP

1. Вывод хостов и их статус в коллекции
Get-RDSessionHost -ConnectionBroker "name_broker.local" -CollectionName "name_collection"


2. Список сессий во всех коллекциях
Get-RDUserSession -ConnectionBroker "name_broker.local"

3. Поиск на каком rds сессия пользователя
Get-RDUserSession -ConnectionBroker "name_broker.local" | Where-Object {$_.Username -like 'login'}

4. Разрешить создавать новые сессии на rds
Set-RDSessionHost -SessionHost "name_rds_server.local" -NewConnectionAllowed Yes -ConnectionBroker "name_broker.local"

5. Запретить создавать новые сессии на rds
Set-RDSessionHost -SessionHost "name_rds_server.local" -NewConnectionAllowed No -ConnectionBroker "name_broker.local"

6. Список все серверов в ферме с их ролями
 Get-RDServer -ConnectionBroker name_broker.local

7. Добавить сервер как узел сеансов
Add-RDServer -Server "name_rds_server.local" -Role "RDS-RD-SERVER" -ConnectionBroker "name_broker.local"

8. Добавить сервер в коллекцию
Add-RDSessionHost -SessionHost "name_rds_server.local" -CollectionName "name_collection" -ConnectionBroker "name_broker.local"


9. Вывод, опубликованных приложений в коллекции
Get-RDRemoteApp -ConnectionBroker "name_broker.local" -CollectionName "name_collection"

10. Вывод, прав на коллекцию
Get-RDSessionCollectionConfiguration -CollectionName "name_collection" -UserGroup -ConnectionBroker "name_broker.local"


11. Вывод всех серверов rds во всех коллекциях
Get-RDSessionCollection -ConnectionBroker "name_broker.local" | Select-Object -Property collectionname | ForEach-Object -Process { Get-RDSessionHost -ConnectionBroker "name_broker.local" -CollectionName $_.collectionname |  Sort-Object -Property SessionHost}

12. Добавить права на коллекции группе
Set-RDSessionCollectionConfiguration -CollectionName "name_collection" -ConnectionBroker "name_broker.local" -UserGroup "domain\name_group"