Sunday, October 22, 2017

Windows Server 2008 R2 STD - The RDP protocol component X.224 detected an error

EventID 56 description:

The Terminal Server security layer detected an error in the protocol stream and has disconnected the client. Client IP: www.xxx.yyy.zzz 

EventID 50 description:

The RDP protocol component X.224 detected an error in the protocol stream and has disconnected the client.


1.       Run the following commands on both the client and the server to disable NIC offloading.

netsh int tcp set global chimney=disabled
netsh int tcp set global rss=disabled

2.    Modify the following registry key to disable netDMA on the client and the server.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\EnableTCPA

Note: If this registry entry does not exist, right-click Parameters, point to New, click DWORD Value, type EnableTCPA, and then press ENTER.

Value: 0

You can also refer to the following KB to troubleshoot the issue. Hope it helps.


If it doesn't work , follow the below step 


Step I:
Added a new DWORD key named DisableTaskOffload with a value of 1 to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
Step II:
Changed IPv4 Checksum Offload for PROD NIC in Advanced Settings.
After these changes, no more issues with RDP not been connected at first attempt or performance issues.
enter image description here