Remote desktop connection issues

[spinaltap]

I'm not entirely sure if I should be posting here, in the tech support section, or in operating systems, but I figured this was the logical place.

Anyways, I'm having some strange issues when trying to remote desktop into my desktop computer from my laptop. Both computers are running Windows XP Pro SP2, both have remote desktop enabled from system preferences, and both have firewalls disabled. Remote desktoping (is that a word?) from my desktop to my laptop is completely fine, but for some reason it will not work the other way around. When I try I get one of two error messages:

1) The connection was ended because of a network error. Please try connecting to the remote computer again.

2) The client could not establish a connection to the remote computer.
The most likely causes of error are:
1) Remote connections might not be enabled on this computer.
2) The maximum number of connections was exceeded at the remote computer.
3) A network error occurred while establishing the connection.

In my attempts to narrow down to the source of the error, this is what I have determined: Since I have enabled remote desktop and nobody else is connected to my computer, this is slightly confusing. "Network Error" is also just about as ambiguous as you can get so I didn't really know what to think about that. Since I can remotely connect the other way around (desktop to laptop) and can also share files between both computers with ease I know its not a problem with the network. Additionally, I can remote desktop from my laptop to other computers on the network without problems (and have the same issues remote desktopping from other networked computers to my desktop computer) so I dont think my laptop is at fault. This leaves only my desktop to shoulder the blame.

Next I tried to evaluate the processes and sockets running during a remote desktop and found out some interesting information. Below is the sequence of events seen by my desktop when attempting to make a remote connection:

0.79487071 svchost.exe:1020 8234FD70 IRP_MJ_CREATE TCP:Connection obj SUCCESS Context:0x823E6188
0.79491225 svchost.exe:1020 8234FD70 TDI_ASSOCIATE_ADDRESS TCP:Connection obj SUCCESS TCP:0.0.0.0:3389
0.82243197 svchost.exe:1020 82433380 IRP_MJ_DEVICE_CONTROL TCP:<none> SUCCESS IOCTL_TCP_SET_INFORMATION_EX
0.82255378 svchost.exe:1020 82433380 TDI_RECEIVE TCP:192.168.1.8:3389 SUCCESS Length:530 Flags:
0.82264596 svchost.exe:1020 82433380 TDI_SEND TCP:192.168.1.8:3389 SUCCESS-47 Length:11
0.83031359 svchost.exe:1020 82433380 TDI_SEND TCP:192.168.1.8:3389 SUCCESS Length:333
0.84112222 svchost.exe:1020 82433380 TDI_SEND TCP:192.168.1.8:3389 SUCCESS Length:11
0.84470577 svchost.exe:1020 82433380 TDI_SEND TCP:192.168.1.8:3389 SUCCESS Length:15
0.84661858 svchost.exe:1020 82433380 TDI_SEND TCP:192.168.1.8:3389 SUCCESS Length:15
0.84948984 svchost.exe:1020 82433380 TDI_SEND TCP:192.168.1.8:3389 SUCCESS Length:15
0.85164584 svchost.exe:1020 82433380 TDI_SEND TCP:192.168.1.8:3389 SUCCESS Length:15
0.85595035 svchost.exe:1020 82433380 TDI_SEND TCP:192.168.1.8:3389 SUCCESS Length:15
0.86242470 svchost.exe:1020 82433380 TDI_SEND TCP:192.168.1.8:3389 CANCELLED-57 Length:48
0.86244923 svchost.exe:1020 82433380 TDI_DISCONNECT TCP:192.168.1.8:3389 SUCCESS ABORT
0.86287100 svchost.exe:1020 82433380 IRP_MJ_DEVICE_CONTROL TCP:192.168.1.8:3389 SUCCESS IOCTL_TCP_SET_INFORMATION_EX
0.86294098 svchost.exe:1020 82433380 IRP_MJ_CLEANUP TCP:192.168.1.8:3389 SUCCESS-63
0.86297026 svchost.exe:1020 82433380 IRP_MJ_CLOSE TCP:192.168.1.8:3389 SUCCESS

The important things that I took away from this were that this is a process contained in svchost.exe (which turns out to be the svchost.exe -k DcomLaunch process) and that it seems like the remote control command is received and recognized by my desktop. At some point after a bunch of send commands, the process just cancels and disconnects with some error code. I'm not too familiar with sockets return codes, however (I think thats what those are in the rightmost column) so I wasn't quite sure how to interpret things beyond this point. I've also tried to mess with the process itself. I replaced the svchost.exe file with one i knew worked (from my laptop) and even the two dll files which it made calls to (termsrv.dll and rpcss.dll), but still I get the same error. I also tried to look at the connection attempt from my laptops point of view at a sockets level, but I didn't really learn anything new from that. I honestly don't know what else to try at this point. If any of you have any insight to other tests I could run or other possible sources of error that would be greatly appreciated.

Oh, I don't know if this is useful or not, but I'm pretty sure I've had remote desktop working on my current installation of windows. This was roughly a year ago, though, so I'm not entirely sure if I've reformatted since then.

 

[Makaveli]

what are the specs on your desktop? Board? Nic?

 

[spinaltap]

Sorry bout that. Here are the relevent specs (althought I feel like this is more of a software issue than hardware considering i can remote desktop to other computers on the network from my desktop comp):

CPU: 2.8 GHz P4 (with HT)
MOBO: MSI 865PE Neo2-FIS2R (not sure about the NIC. It's the built in ethernet...gigabit CSA)
RAM: 512 MB
HDD: ~200GB across 3 harddrives
Vid: GeForce 3 Ti500
OS: Windows XP Pro SP2

 

[stash]

Are there any terminal services errors in the event logs of the system you are trying to connect to?

 

[mantrius]

This is probably silly, but did you make sure the windows firewall (and/or whatever other personal firewalls may be installed) was disabled or allowing an exception for Remote Desktop?

 

[spinaltap]

stash: I would suspect that maybe there are terminal service errors, although I don't know how/where I would find these. I checked in the Manage dialog but couldn't find it. Where else should I check?

mantrius: Nope, all of that stuff is turned off. I don't have any other firewall software and the windows one is disabled. I even tried to disable it while having Remote Desktop as an exception (redundant and silly i know, but at this point i was trying basically everything that came to mind) to no avail.

 

[stash]

Originally posted by: spinaltap
stash: I would suspect that maybe there are terminal service errors, although I don't know how/where I would find these. I checked in the Manage dialog but couldn't find it. Where else should I check?

You can access the event logs by going to start, run and typing 'eventvwr'

 

[spinaltap]

Thanks man. The eventvwr definately pointed me in the right direction. It was a termDD error in my system log (event ID: 50) which was able to look up in microsofts support knowledgebase. It turns out the problem was in my registry...somehow. All i had to do was kill a certificate parameter in my termservice registry directory and reboot and everything worked perfectly.

Thanks again, and for any of you who end up running into similar problems. Definately check the event viewer because it should be able to point you in the right direction.