Troubleshooting SBSL Errors in RDP Connections to Windows Server 2012 R2

Table of Contents

This article addresses a common issue encountered when connecting to Windows Server 2012 R2 using Remote Desktop Protocol (RDP): server freezes or significantly slow user logons. This problem can severely impact productivity and user experience. Understanding the root cause and implementing the provided solution is crucial for maintaining a stable and responsive remote server environment. This guide will walk you through the symptoms, causes, and a step-by-step resolution to mitigate these SBSL-related errors.

Symptoms¶

You may experience the following symptoms when encountering this issue:

• Server Freezes: Upon establishing an RDP connection to a Windows Server 2012 R2 machine, the server becomes unresponsive. This freeze can occur immediately after connection or during active sessions, forcing a server restart to regain control.
• Slow User Logons: New user logons via RDP take an excessively long time, sometimes appearing to hang indefinitely. This delay can occur even before the user enters their credentials, indicating a bottleneck in the initial connection and authentication process. Users might experience prolonged wait times, leading to frustration and disruption of workflow.
• Intermittent Connectivity Issues: In some instances, the problem might not be consistently reproducible, manifesting as intermittent freezes or slow logons. This sporadic nature can make troubleshooting more challenging, as the issue may appear and disappear without an immediately apparent pattern.
• Event Log Errors: Examining the Windows Server 2012 R2 event logs, particularly the System and Application logs, might reveal errors related to Remote Desktop Services (RDS), Kerberos authentication, or network connectivity. These logs can provide valuable clues in pinpointing the underlying problem and validating the SBSL error scenario.

These symptoms, especially when occurring in conjunction, strongly suggest the presence of the SBSL error condition affecting RDP connections. It is important to differentiate these symptoms from general network latency or server overload issues, as the resolution specifically targets the deadlock condition described in the cause section.

Cause¶

The root cause of these symptoms lies in a deadlock condition involving several critical system components: Remote Desktop Services (RDS), the Local Security Authority Subsystem Service (lsass) specifically concerning Kerberos authentication, and the redirector. This deadlock arises during the user logon process when RDS attempts to retrieve user configuration data.

Specifically, the sequence of events leading to the deadlock is as follows:

1. RDS User Configuration Retrieval: When a user initiates an RDP connection, the RDS service (termsrv.dll) begins the process of loading the user’s profile and configuration settings. This is a standard procedure to ensure a personalized and consistent user experience across different sessions.
2. Remote Registry Calls to Domain Controller: To obtain user configuration data, RDS initiates remote registry calls directed towards the domain controller. In a domain environment, user profiles and policies are often centrally managed, and the domain controller serves as the authoritative source for this information.
3. Kerberos Authentication (lsass): These remote registry calls involve Kerberos authentication handled by lsass. Kerberos is the default authentication protocol in Windows domains, ensuring secure communication and identity verification between the server and the domain controller.
4. Redirector Involvement: The redirector, responsible for network redirection and communication, plays a role in facilitating these remote registry calls across the network to the domain controller.

The deadlock occurs when these components become interlocked in a circular dependency while trying to access resources. This typically happens when the communication with the domain controller is slow or unreliable.

The slow or hung logons are a direct consequence of delays introduced by the RDS service’s API calls to the domain controller. These round trips between the RDS server and the domain controller can introduce significant latency due to:

• Slow or Congested Network Link: A slow, congested, or unreliable network connection between the Windows Server 2012 R2 machine and the domain controller is a primary contributor. Packet loss and network congestion necessitate retransmissions, dramatically increasing the time taken for data transfer and response. Network latency, even if seemingly minor, can be amplified by the multiple round trips required for user configuration retrieval, leading to noticeable delays.
• Domain Controller Performance Issues: If the domain controller itself is experiencing performance bottlenecks, such as high CPU utilization, disk I/O contention, or memory pressure, it will respond to requests slowly. This slow response from the domain controller directly translates into delays in user logon processes on the RDS server. Issues on the domain controller, even if unrelated to network connectivity, can therefore manifest as RDP performance problems on the Windows Server 2012 R2 machine.

Understanding this intricate interaction between RDS, Kerberos, the redirector, and the domain controller is essential for appreciating the resolution strategy, which aims to bypass the domain controller dependency during user logon.

Resolution¶

The recommended resolution for this issue in Windows Server 2012 R2 involves disabling the Domain Controller requests during the user logon process. This effectively circumvents the conditions that lead to the deadlock and significantly improves logon performance in affected environments. This is achieved by creating and configuring a specific registry entry.

By disabling Domain Controller requests for user configuration during logon, the system relies on locally cached user profile information. This eliminates the network dependency and the potential for delays or deadlocks associated with communicating with the domain controller during the critical logon phase.

To implement this resolution, you need to create the fQueryUserConfigFromLocalMachine registry entry. Follow these steps carefully:

1. Open Registry Editor:

   • Press the Windows logo key + R simultaneously to open the Run dialog box.
   • Type regedit.exe in the Open box.
   • Click OK or press Enter to launch the Registry Editor.

   

   Caution: Modifying the registry incorrectly can cause serious problems that may require you to reinstall your operating system. Back up the registry before making any changes.

2. Navigate to the Registry Subkey:
   In the Registry Editor window, locate and navigate to one of the following registry subkeys using the left-hand pane:

   • HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Terminal Services (This path is typically used if you are managing settings via Group Policy.)
   • HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Terminal Server\WinStations\<Connection Name> (This path allows for configuration at the connection level.)

   Note: By default, the <Connection Name> value is RDP-Tcp. If you have renamed or customized your RDP connection, replace <Connection Name> with the appropriate name.

   

3. Create a New DWORD Value:

   • In the Registry Editor, navigate to your chosen subkey from step 2.
   • Right-click in the right-hand pane (the area showing registry values).
   • Hover over New in the context menu.
   • Select DWORD (32-bit) Value.

   

4. Name the New Value:

   • A new DWORD value will be created with a default name (e.g., “New Value #1”).
   • Rename this new value to fQueryUserConfigFromLocalMachine (exactly as typed, case-sensitive).

   

5. Modify the Value Data:

   • Right-click on the newly created fQueryUserConfigFromLocalMachine value.
   • Select Modify… from the context menu.

   

6. Set the Value Data:

   • In the Edit DWORD (32-bit) Value dialog box, locate the Value data field.
   • Type 1 in the Value data box. This sets the value to enable the local configuration query.
   • Ensure the Base is set to Hexadecimal or Decimal (either will work for a value of 1).
   • Click OK to save the changes.

   

7. Exit Registry Editor:

   • Close the Registry Editor application.

   Restart Requirement: While a server restart is generally recommended after registry changes, it might not be strictly necessary for this specific setting to take effect. However, to ensure the change is fully applied, it’s best practice to restart the Windows Server 2012 R2 machine after making this registry modification.

After implementing these steps, RDP connections should no longer be affected by the SBSL-related deadlock, and user logons should return to normal performance levels. Monitor the system after applying the fix to confirm the issue is resolved.

Alternative Solution: Upgrade to Windows Server 2016 or Later

An alternative and more comprehensive solution to this issue is to upgrade to Windows Server 2016 or a later version. Microsoft has addressed this deadlock condition in newer versions of the Windows Server operating system. Upgrading not only resolves the SBSL error but also provides access to enhanced features, improved security, and performance optimizations inherent in the newer server platforms.

Upgrading to a more recent version of Windows Server is a longer-term solution that provides broader benefits than just addressing this specific RDP issue. It ensures you are running on a supported and actively maintained platform, receiving the latest security updates and performance improvements.

Summary of Resolution Steps:

Step	Action	Description
1	Open Registry Editor	Launch regedit.exe from the Run dialog.
2	Navigate to Registry Subkey	Go to either HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Terminal Services or HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Terminal Server\WinStations\<Connection Name>.
3	Create DWORD Value	Create a new DWORD (32-bit) Value.
4	Name the Value	Rename the new value to fQueryUserConfigFromLocalMachine.
5	Modify Value Data	Open the value for editing.
6	Set Value Data	Set the “Value data” to 1.
7	Exit Registry Editor	Close Registry Editor. Restart server (recommended).
Alternative	Upgrade to Windows Server 2016+	Consider upgrading for a permanent fix and broader benefits.

By carefully following these steps, you can effectively resolve SBSL errors causing server freezes and slow logons in RDP connections to Windows Server 2012 R2. Remember to back up your registry before making changes and consider upgrading to a newer Windows Server version for a more permanent and feature-rich solution.

Do you have any experiences with SBSL errors or other RDP performance issues? Share your thoughts and questions in the comments below!