Troubleshooting Remote Desktop Connection Issues with VDI on Windows Server

Table of Contents

This article addresses a common issue encountered when attempting to establish a Remote Desktop connection to a Virtual Desktop Infrastructure (VDI)-based remote computer. Specifically, this problem arises after the Microsoft RemoteFX 3D Video Adapter has been enabled. Understanding the root cause and implementing the appropriate resolution steps are crucial for maintaining seamless remote access in VDI environments. This guide provides a detailed solution to restore Remote Desktop connectivity in such scenarios.

Symptoms¶

After successfully installing the RemoteFX 3D Video Adapter on either a physical machine configured for VDI or a virtual machine hosted on a Hyper-V server, you might encounter difficulties when attempting to connect to this machine using Remote Desktop. The connection attempt may fail, and you might be presented with an error message. This error message typically indicates a general connectivity problem, suggesting that the remote computer is unreachable or remote access is not enabled.

The error message often displays the following:

Remote Desktop can’t connect to the remote computer for one of these reasons:

1. Remote access to the server is not enabled
2. The remote computer is turned off
3. The remote computer is not available on the network

Make sure the remote computer is turned on and connected to the network, and that remote access is enabled.

Despite verifying that the remote computer is indeed powered on, connected to the network, and remote access is generally enabled, the Remote Desktop connection persistently fails. Furthermore, examining the Windows Event Log can reveal more specific details about the failure.

Within the Windows Event Log, under the “Microsoft-Windows-TerminalServices-LocalSessionManager/Operational” log, you may find an error event with the following characteristics:

Log Name: Microsoft-Windows-TerminalServices-LocalSessionManager/Operational
Source: Microsoft-Windows-TerminalServices-LocalSessionManager
Date: <Date><Time>
Event ID: 17
Level: Error
User: SYSTEM
Computer: machinename.domain.com
Description:
Remote Desktop Service start failed. The relevant status code was 0x800706b5.

This Event ID 17, coupled with the status code 0x800706b5, strongly indicates an issue related to the Remote Desktop Service failing to start correctly, particularly in conjunction with the RemoteFX 3D Video Adapter.

It is also important to note that a workaround exists to temporarily bypass this issue. If you remove the RemoteFX 3D Video Adapter from the virtual machine’s configuration, you will likely be able to connect to the computer using Remote Desktop Protocol (RDP) without any problems. This observation further points to the RemoteFX adapter as the primary source of the connectivity issue.

Cause¶

The root cause of this Remote Desktop connection failure lies in the interaction between the RemoteFX 3D Video Adapter and the Windows Firewall. With the introduction of Service Pack 1 for both Windows 7 and Windows Server 2008 R2, Microsoft included a new Windows Firewall rule specifically designed for RemoteFX. This rule is intended to manage network traffic associated with RemoteFX functionalities.

The problem arises when this crucial RemoteFX Windows Firewall rule is not enabled. If the rule remains disabled after the RemoteFX 3D Video Adapter is installed, it effectively blocks the necessary network communication required for Remote Desktop to function correctly when utilizing RemoteFX. Consequently, connection attempts are rejected, leading to the error messages and event log entries described earlier.

To gain a deeper understanding of Microsoft RemoteFX and its capabilities, you can refer to the official Microsoft documentation available online. This resource provides comprehensive information about RemoteFX, its features, and its intended use cases within virtualized environments. Understanding the technology behind RemoteFX can provide valuable context for troubleshooting and resolving related issues.

Resolution¶

To effectively resolve the Remote Desktop connection problem caused by the disabled RemoteFX Windows Firewall rule, you must manually enable this rule within the Windows Firewall settings. Enabling this rule will allow the necessary network traffic to pass through, restoring Remote Desktop connectivity when RemoteFX is in use. There are two primary methods to enable the RemoteFX Windows Firewall rule.

Method 1: Enabling RemoteFX Rule Using Windows Firewall with Advanced Security¶

This method provides a direct and granular way to manage firewall rules, allowing you to specifically enable the RemoteFX rule.

1. Begin by clicking the Start button, typically located in the bottom-left corner of your screen. From the Start Menu, navigate to and click on Control Panel. This will open the Control Panel window, providing access to various system settings.

2. Within the Control Panel window, locate and click on Windows Firewall. You may need to adjust the Control Panel view (e.g., to “Category” view) to easily find the “Windows Firewall” option under “System and Security”. Clicking on “Windows Firewall” will open the main Windows Firewall control panel.

3. In the left-hand pane of the Windows Firewall control panel, you will see several options. Click on Allow a program or feature through Windows Firewall. This option will take you to the settings where you can manage exceptions and allowed programs for the firewall.

4. In the “Allowed programs and features” window, you will need to make changes. Click on the Change settings button. Note that this action might require administrative privileges. If you are prompted for an administrator password or confirmation, enter the password or provide the necessary confirmation to proceed.

5. Once you have clicked “Change settings,” the list of “Allowed programs and features” becomes editable. Scroll through the list and locate the entry labeled Remote Desktop - RemoteFX. Place a checkmark in the checkbox next to this entry to select it.

6. After selecting “Remote Desktop - RemoteFX,” you will notice columns to the right of the program name, typically labeled “Private” and “Public.” These columns represent network location types. Use the checkboxes within these columns to specify the network locations on which you want to allow RemoteFX communication. For instance, if you are only connecting from within your private network, you might only check the “Private” box. If you need to allow connections from public networks as well, you would check the “Public” box. Consider your security requirements when selecting network locations.

7. After configuring the network locations for the “Remote Desktop - RemoteFX” rule, click OK to save your changes and close the Windows Firewall settings. The RemoteFX Windows Firewall rule is now enabled.

Method 2: Enabling RemoteFX Rule via System Properties (Automatic Enablement)¶

This method leverages the System Properties window to manage Remote Desktop settings. Interestingly, when you enable Remote Desktop through this interface, the RemoteFX firewall rule is automatically enabled in the background.

1. Similar to the first method, begin by clicking the Start button and then selecting Control Panel to open the Control Panel window.

2. Within the Control Panel, find and click on the System icon. If you are in “Category” view, this is usually under “System and Security.” Clicking on “System” will open the System window, displaying basic information about your computer.

3. In the System window, on the left-hand side, you will see a list of options under “Control Panel Home.” Click on Remote settings. This will open the “System Properties” window directly to the “Remote” tab.

4. In the “System Properties” window, navigate to the Remote tab. Under the “Remote Desktop” section, you will see options to control Remote Desktop access. Initially, select the option Don’t allow connections to this computer. Click the Apply button after selecting this option. This step is crucial as it essentially resets the Remote Desktop configuration before re-enabling it.

5. Now, you need to re-enable Remote Desktop. Select either of the following options under “Remote Desktop” based on your security requirements:

   • Allow connections from computers running any version of Remote Desktop (less secure): This option provides broader compatibility, allowing connections from older Remote Desktop clients. However, it is considered less secure.
   • Allow connections only from computers running Remote Desktop with Network Level Authentication (more secure): This option enhances security by requiring Network Level Authentication (NLA). NLA adds an extra layer of authentication before the remote desktop session is fully established, mitigating certain security risks. This is the recommended option for most environments.

6. After selecting your preferred Remote Desktop option, click Apply and then click OK to save your changes and close the System Properties window. By enabling Remote Desktop through this method, the RemoteFX Windows Firewall rule is automatically enabled in the background, resolving the connectivity issue.

More Information¶

It is important to understand that the manual enablement of the RemoteFX Windows Firewall rule is specifically necessary when you enable Remote Desktop for a VDI machine using certain methods. If you configure Remote Desktop through the System Properties window as described in Method 2, the rule is typically enabled automatically.

However, if you employ alternative methods to enable Remote Desktop for VDI, such as using command-line tools, PowerShell scripts, or Group Policy settings that directly configure Remote Desktop without going through the System Properties interface, the RemoteFX firewall rule might not be enabled automatically. In such cases, you must manually enable the rule using Method 1 (Windows Firewall with Advanced Security) to ensure proper Remote Desktop functionality when RemoteFX is in use.

Understanding these nuances can help you effectively troubleshoot and resolve Remote Desktop connectivity issues in VDI environments where RemoteFX is deployed. Always ensure that the RemoteFX Windows Firewall rule is enabled when using the RemoteFX 3D Video Adapter to guarantee seamless remote access.

If you continue to experience issues, double-check that the Remote Desktop service is running and that there are no other conflicting firewall rules or network policies blocking the connection. Reviewing the Windows Event Logs for any additional error messages can also provide further clues for troubleshooting.

Do you have any experiences with Remote Desktop and RemoteFX issues? Share your troubleshooting tips and questions in the comments below!