"The client could not connect to the remote computer. Remote connections..." - Server 2003

[Maestro]

"The client could not connect to the remote computer. Remote
connections might not be enabled or the computer might be too busy to
accept new connections. It is also possible that network problems are
preventing your connection.
Please try connecting again later. If the problem continues to occur,
contact your administrator."

I have Windows Server 2003 and am using Session Directory and Load
Balancing Using Terminal Server. Seems like an Administrator can log
on to this "cluster" (i use the term loosely) without issues. but
when a user attempts to, they get the above error message.

In "Network Load Balancing Manager" under Host Properties/Port Rules
tab - i have set the:
Cluster IP address = All
Start = 3389
End = 3389
Protocol = Both
Mode = Multiple
Priority = -- (shows this but is actually set to 1 for the NLBM and 2
for the other server)
Load = Equal
Affinity = None

So I don't think this is the issue

In Users/Groups of the local box i have "Domain Users" in the groups
"Users" and "Remote Desktop Users"

UPDATE
David - one of my programmers can RDP to TS1 without an issue and
cannot to TS2. get's the above error and is an administrator of TS2

Now I'm really stuck - Please Advise

[Maestro]

"Because of a security error, the client could not connect to the
remote computer. Verify that you are logged on to the network, and
then try connecting again." specific error of David

[Maestro]

http://support.microsoft.com/kb/329896 shows fix for the above error,
states:
United States *

Quick Links | Home | Worldwide
Microsoft *
Search Microsoft.com for:
Help and Support
Help and Support Home | Select a Product | Advanced Search
Because of a security error, the client could not connect to the
Terminal Server
View products that this article applies to.
Article ID : 329896
Last Review : February 28, 2007
Revision : 3.4
This article was previously published under Q329896
Important This article contains information about how to modify the
registry. Make sure to back up the registry before you modify it. Make
sure that you know how to restore the registry if a problem occurs.
For more information about how to back up, restore, and modify the
registry, click the following article number to view the article in
the Microsoft Knowledge Base:
256986 (http://support.microsoft.com/kb/256986/) Description of the
Microsoft Windows registry
SYMPTOMS
After you upgrade a Microsoft Windows NT domain to Microsoft Windows
2000 or Microsoft Windows Server 2003, Windows 2000 Terminal Services
clients may be repeatedly denied access to the terminal server. If you
are using a Terminal Services client to log on to the terminal server,
you may receive one of the following error messages:
Because of a security error, the client could not connect to the
Terminal server. After making sure that you are logged on to the
network, try connecting to the server again.
-or-
Remote desktop disconnected. Because of a security error, the client
could not connect to the remote computer. Verify that you are logged
onto the network and then try connecting again.
Additionally, the following event ID messages may be logged in Event
Viewer on the terminal server:
Event ID: 50
Event Source: TermDD
Event Description: The RDP protocol component X.224 detected an error
in the protocol stream and has disconnected the client.
-and-
Event ID: 1008
Event Source: TermService
Event Description: The terminal services licensing grace period has
expired and the service has not registered with a license server. A
terminal services license server is required for continuous operation.
A terminal server can operate without a license server for 90 days
after initial start up.
-and-
Event ID: 1004
Event Source: TermService
Event Description: The terminal server cannot issue a client license.
-and-
Event ID: 1010
Event Source: TermService
Event Description: The terminal services could not locate a license
server. Confirm that all license servers on the network are registered
in WINS\DNS, accepting network requests, and the Terminal Services
Licensing Service is running.
-and-
Event ID: 28
Event Source: TermServLicensing
Event Description: Terminal Services Licensing can only be run on
Domain Controllers or Server in a Workgroup. See Terminal Server
Licensing help topic for more information.

Back to the top
CAUSE
This issue may occur if a certificate on the terminal server is
corrupted.

Back to the top
RESOLUTION
Warning Serious problems might occur if you modify the registry
incorrectly by using Registry Editor or by using another method. These
problems might require that you reinstall your operating system.
Microsoft cannot guarantee that these problems can be solved. Modify
the registry at your own risk.

To resolve this issue, back up and then remove the X509 Certificate
registry keys, restart the computer, and then reactivate the Terminal
Services Licensing server. To do this, follow these steps.

NOTE: Perform the following procedure on each of the terminal servers.
1. Make sure that the terminal server registry has been successfully
backed up.
2. Start Registry Editor.
3. Locate and then click the following registry subkey:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermService
\Parameters
4. On the Registry menu, click Export Registry File.
5. Type exported-parameters in the File name box, and then click Save.

NOTE: If you have to restore this registry subkey in the future,
double-click the Exported-parameters.reg file that you saved in this
step.
6. Under the Parameters registry subkey, right-click each of the
following values, click Delete, and then click Yes to confirm the
deletion:
Certificate
X509 Certificate
X509 Certificate ID
7. Quit Registry Editor, and then restart the server.
8. Reactivate the Terminal Services Licensing server by using the
Telephone connection method in the Licensing Wizard.

NOTE: If you activate the Terminal Services Licensing server using the
Telephone option, the licensing server uses a different form of
certificate.

Back to the top
MORE INFORMATION
For more information, click the following article numbers to view the
articles in the Microsoft Knowledge Base:
306578 (http://support.microsoft.com/kb/306578/) How to deactivate or
reactivate a License Server using Terminal Services Licensing
323597 (http://support.microsoft.com/kb/323597/) Windows XP clients
cannot connect to a Windows 2000 Terminal Services Server

Back to the top
APPLIES TO
· Microsoft Windows Server 2003, Datacenter Edition (32-bit x86)
· Microsoft Windows Server 2003, Enterprise Edition (32-bit x86)
· Microsoft Windows Server 2003, Standard Edition (32-bit x86)
· Microsoft Windows Server 2003, Web Edition
· Microsoft Windows 2000 Server
· Microsoft Windows 2000 Advanced Server

Back to the top
Keywords:
kbprb KB329896

Back to the top

Provide feedback on this article
Did this article help you solve your problem?
Yes
No
Partially
I do not know yet

Strongly Agree Strongly Disagree
9 8 7 6 5 4 3 2 1
The article is easy to understand

The article is accurate

Additional Comments:
To protect your privacy, do not include contact information in your
feedback.
Thank you! Your feedback is used to help us improve our support
content. For more assistance options, please visit the Help and
Support Home Page.

Search Support (KB)

Switch to Advanced Search
Article Translations

Related Support Centers

* Windows Server 2003
* Windows 2000

Other Support Options

* Contact Microsoft
Phone Numbers, Support Options and Pricing, Online Help, and
more.
* Customer Service
For non-technical assistance with product purchases,
subscriptions, online services, events, training courses, corporate
sales, piracy issues, and more.
* Newsgroups
Pose a question to other users. Discussion groups and Forums
about specific Microsoft products, technologies, and services.

Page Tools

* Print this page
* E-mail this page
* Microsoft Worldwide
* Save to My Support Favorites
* Go to My Support Favorites
* Send Feedback
*

[Maestro]

Because of a security error, the client could not connect to the
terminal server. After making sure that you are logged on to the
network, try connecting to the server again.

Cause: If you upgraded a Windows NT domain to Windows 2000 or Windows
Server 2003, then the certificate on the terminal server might be
corrupt. As a result, Windows 2000 Terminal Services clients might be
repeatedly denied access to the terminal server.

Solution: On each terminal server and client, perform the following
steps:

1. On each terminal server, create a backup of the registry.

2. Navigate to the following registry subkey: HKLM\SYSTEM
\CurrentControlSet\Services\TermServices\Parameters.

3. On the Registry menu, click Export Registry File.

4. In the File name box, type exported-parameters, and then click
Save.

If you need to restore this registry subkey in the future, double-
click exported-parameters.reg.

5. Under the Parameters registry subkey, right-click each of the
following values:
-Certificate
-X509 Certificate
-X509 Certificate ID

6. Click Delete, and then click Yes to confirm the deletion.

7. Close Registry Editor, and then restart each terminal server.

8. On the client, create a backup of the MSLicensing registry key and
its subkeys, and then remove the original key and subkeys by doing the
following:
-Navigate to the following registry subkey: HKEY_LOCAL_MACHINE\SOFTWARE
\Microsoft\MSLicensing.
-Click MSLicensing.
-On the Registry menu, click Export Registry File.
-In the File name box, type mslicensingbackup, and then click Save.
-If you need to restore this registry key in the future, double-click
mslicensingbackup.reg.
-On the Edit menu, click Delete, and then click Yes to confirm the
deletion of the MSLicensing registry subkey.
-Close Registry Editor, and then restart the client computer.

Caution

Incorrectly editing the registry may severely damage your system.
Before making changes to the registry, you should back up any valued
data on the computer.

Solution: If the client still cannot connect to the terminal server,
perform the following variation of this procedure:

1. Deactivate the license server.

2. Reactivate the license server by using the Telephone connection
method in the Terminal Server License Server Wizard.
NOTE: When you activate Terminal Server Licensing by using the
Telephone option, Terminal Server Licensing uses a different
certificate.

3. On each terminal server, create a backup of the registry, and then
delete the Certificate, X509 Certificate, and X509 Certificate ID
registry keys, as described in the preceding procedure.

4. Close Registry Editor, and then restart each terminal server.

5. On the client, create a backup of the MSLicensing registry key and
its subkeys on the client, and then remove the original key and
subkeys as described in the preceding procedure.

6. Close Registry Editor, and then restart the computer.

When the client is restarted, the missing registry key is rebuilt.

See also:
Deactivate a Terminal Server license server @
http://technet2.microsoft.com/Window...244b41033.mspx
Reactivate a Terminal Server license server @
http://technet2.microsoft.com/Window...006eb1033.mspx

[Maestro]

http://support.microsoft.com/kb/329896 shows fix for the above error,
states:
United States *

Quick Links | Home | Worldwide
Microsoft *
Search Microsoft.com for:
Help and Support
Help and Support Home | Select a Product | Advanced Search
Because of a security error, the client could not connect to the
Terminal Server
View products that this article applies to.
Article ID : 329896
Last Review : February 28, 2007
Revision : 3.4
This article was previously published under Q329896
Important This article contains information about how to modify the
registry. Make sure to back up the registry before you modify it. Make
sure that you know how to restore the registry if a problem occurs.
For more information about how to back up, restore, and modify the
registry, click the following article number to view the article in
the Microsoft Knowledge Base:
256986 (http://support.microsoft.com/kb/256986/) Description of the
Microsoft Windows registry
SYMPTOMS
After you upgrade a Microsoft Windows NT domain to Microsoft Windows
2000 or Microsoft Windows Server 2003, Windows 2000 Terminal Services
clients may be repeatedly denied access to the terminal server. If you
are using a Terminal Services client to log on to the terminal server,
you may receive one of the following error messages:
Because of a security error, the client could not connect to the
Terminal server. After making sure that you are logged on to the
network, try connecting to the server again.
-or-
Remote desktop disconnected. Because of a security error, the client
could not connect to the remote computer. Verify that you are logged
onto the network and then try connecting again.
Additionally, the following event ID messages may be logged in Event
Viewer on the terminal server:
Event ID: 50
Event Source: TermDD
Event Description: The RDP protocol component X.224 detected an error
in the protocol stream and has disconnected the client.
-and-
Event ID: 1008
Event Source: TermService
Event Description: The terminal services licensing grace period has
expired and the service has not registered with a license server. A
terminal services license server is required for continuous operation.
A terminal server can operate without a license server for 90 days
after initial start up.
-and-
Event ID: 1004
Event Source: TermService
Event Description: The terminal server cannot issue a client license.
-and-
Event ID: 1010
Event Source: TermService
Event Description: The terminal services could not locate a license
server. Confirm that all license servers on the network are registered
in WINS\DNS, accepting network requests, and the Terminal Services
Licensing Service is running.
-and-
Event ID: 28
Event Source: TermServLicensing
Event Description: Terminal Services Licensing can only be run on
Domain Controllers or Server in a Workgroup. See Terminal Server
Licensing help topic for more information.

Back to the top
CAUSE
This issue may occur if a certificate on the terminal server is
corrupted.

Back to the top
RESOLUTION
Warning Serious problems might occur if you modify the registry
incorrectly by using Registry Editor or by using another method. These
problems might require that you reinstall your operating system.
Microsoft cannot guarantee that these problems can be solved. Modify
the registry at your own risk.

To resolve this issue, back up and then remove the X509 Certificate
registry keys, restart the computer, and then reactivate the Terminal
Services Licensing server. To do this, follow these steps.

NOTE: Perform the following procedure on each of the terminal servers.
1. Make sure that the terminal server registry has been successfully
backed up.
2. Start Registry Editor.
3. Locate and then click the following registry subkey:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermService
\Parameters
4. On the Registry menu, click Export Registry File.
5. Type exported-parameters in the File name box, and then click Save.

NOTE: If you have to restore this registry subkey in the future,
double-click the Exported-parameters.reg file that you saved in this
step.
6. Under the Parameters registry subkey, right-click each of the
following values, click Delete, and then click Yes to confirm the
deletion:
Certificate
X509 Certificate
X509 Certificate ID
7. Quit Registry Editor, and then restart the server.
8. Reactivate the Terminal Services Licensing server by using the
Telephone connection method in the Licensing Wizard.

NOTE: If you activate the Terminal Services Licensing server using the
Telephone option, the licensing server uses a different form of
certificate.

Back to the top
MORE INFORMATION
For more information, click the following article numbers to view the
articles in the Microsoft Knowledge Base:
306578 (http://support.microsoft.com/kb/306578/) How to deactivate or
reactivate a License Server using Terminal Services Licensing
323597 (http://support.microsoft.com/kb/323597/) Windows XP clients
cannot connect to a Windows 2000 Terminal Services Server

Back to the top
APPLIES TO
· Microsoft Windows Server 2003, Datacenter Edition (32-bit x86)
· Microsoft Windows Server 2003, Enterprise Edition (32-bit x86)
· Microsoft Windows Server 2003, Standard Edition (32-bit x86)
· Microsoft Windows Server 2003, Web Edition
· Microsoft Windows 2000 Server
· Microsoft Windows 2000 Advanced Server

Back to the top
Keywords:
kbprb KB329896

[Maestro]

Still Getting this error - the users getting the error are outside the
lan on the wan we are 154.15.xxx.xxx and they are 154.28.xxx.xxx
joined on a point to point connection (10mb) and 1 AD structure for
both sites DC's in both sites that replicate...

any thoughts?

[Maestro]

"The client could not connect to the remote computer. Remote
connections might not be enabled or the computer might be too busy to
accept new connections. It is also possible that network problems are
preventing your connection.
Please try connecting again later. If the problem continues to occur,
contact your administrator."

I have Windows Server 2003 and am using Session Directory and Load
Balancing Using Terminal Server. Seems like an Administrator can log
on to this "cluster" (i use the term loosely) without issues. but
when a user attempts to, they get the above error message.

I've checked rights and i'm about to call Microsoft, any thoughts? ?
anyone?

[Maestro]

Well i fixed the damn thing! -
We have 2 sites - I only received this error from the other site -
we have 2 cisco routers with one side 172.20.20.1 inside interface and
192.168.1.1 for outside with a private line to the other side
192.168.1.2 outside 172.10.10.1 inside
the 172.20 side was the problem - so is statically arpd the connection
on the 172.10 side (which is the default route for the 172.20 side) i
had to use the mac address that's multicasted by the Load Balancing
Manager on the load balancing server.

I hope this helps some one