Forum Discussion

ExceedKevin's avatar
ExceedKevin
Copper Contributor
Jul 07, 2022

Login failure from tssdis.exe on RDS server

Remote desktop server in AD environment [Windows Server 2019 standard, running RDweb, RDG, and session host, etc] periodically has service tssdis.exe (remote desktop session broker) failing to login, Event IDs 4648 and then 4625 about half a dozen times before stopping. This doesn't appear to affect any users, but I can't find anything online addressing it or if it's something that needs to be fixed. Some other people have reported the problem but not the solution, such as here: https://social.technet.microsoft.com/Forums/windowsserver/en-US/26e48e81-1400-4f8c-aef2-df03143fa211/login-through-tssdisexe

 

Below are two exports of the event IDs (sanitized)

 

This is the 4648

A logon was attempted using explicit credentials.

Subject:
    Security ID:        NETWORK SERVICE
    Account Name:        SERVERNAME$
    Account Domain:        DOMAIN
    Logon ID:        0x3E4
    Logon GUID:        {10b9db0d-f9e0-e3ab-8c95-7dcb4ec5b3c7}

Account Whose Credentials Were Used:
    Account Name:        SERVERNAME
    Account Domain:        DOMAIN
    Logon GUID:        {00000000-0000-0000-0000-000000000000}

Target Server:
    Target Server Name:    SERVERNAME.DOMAIN.local
    Additional Information:    SERVERNAME.DOMAIN.local

Process Information:
    Process ID:        0x17c8
    Process Name:        C:\Windows\System32\tssdis.exe

Network Information:
    Network Address:    fe80::xxxx:f30a:xxxx:xxxx
    Port:            49667

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  
This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.

 This is the 4625:

An account failed to log on.

Subject:
    Security ID:        NULL SID
    Account Name:        -
    Account Domain:        -
    Logon ID:        0x0

Logon Type:            3

Account For Which Logon Failed:
    Security ID:        NULL SID
    Account Name:        SERVERNAME
    Account Domain:        DOMAIN

Failure Information:
    Failure Reason:        Unknown user name or bad password.
    Status:            0xC000006D
    Sub Status:        0xC0000064

Process Information:
    Caller Process ID:    0x0
    Caller Process Name:    -

Network Information:
    Workstation Name:    SERVERNAME
    Source Network Address:    fe80::xxxx:f30a:xxxx:xxxx
    Source Port:        50798

Detailed Authentication Information:
    Logon Process:        NtLmSsp 
    Authentication Package:    NTLM
    Transited Services:    -
    Package Name (NTLM only):    -
    Key Length:        0

This event is generated when a logon request fails. It is generated on the computer where access was attempted.

The Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).

The Process Information fields indicate which account and process on the system requested the logon.

The Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The authentication information fields provide detailed information about this specific logon request.
    - Transited services indicate which intermediate services have participated in this logon request.
    - Package name indicates which sub-protocol was used among the NTLM protocols.
    - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.

 

14 Replies

  • mscirri's avatar
    mscirri
    Copper Contributor
    We are seeing the same issue. This one is driving me crazy.
  • acctvrfctn's avatar
    acctvrfctn
    Copper Contributor
    Hello,

    I've been dealing with this issue for several months now. The only fix that I have found is restarting the TSSDIS (Remote Desktop Connection Broker) service. This works for anywhere from a few hours to several weeks. No clue whats causing this issue on my end either.
    • ExceedKevin's avatar
      ExceedKevin
      Copper Contributor
      Thanks for the reply! I'll comment here if I find the solution.
      • MJGenesis's avatar
        MJGenesis
        Copper Contributor

        ExceedKevin, having the same issue as you now that we have a SIEM capturing failed login information on all our key servers.  After doing some more research, I've decided to implement the third step in the solution of the following article to see it gets resolved (see here).  If it does, then I will provide feedback over the next week or two as we monitor activity.  I feel confident it's not a security issue, but still concerned whether there is an operational deficiency somewhere.  Hoping someone from Microsoft can shed light on this.

Resources