RDP into Windows 2008 R2 server just stopped responding

Question

Have a weird situation. I am running a windows 2008 R2 box that has 128 gigs ram and 2 6 core processorss. Box runs like a champ, however, it seems like every week orweek and a half, I can't RDP into it anymore. The handshake is immediate. Username and password start the configuring remote session but it just hangs and hangs and hangs until RDC times out. No other uses but me. No firewall appliance except for Windows firewall. And the box still serves up pages just fine. Any ideas?

Also should be noted if I type a bad password it lets me know so, its connecting... just not enough to get the desktop... Lastly one more thing... when I went to data center and hooked monitor mouse and keyboard I couldn't log in as neither responded.

Solution

The Windows logon process has unexpectedly terminated. Event ID 4005

Searching Google for that returns a number of links, most of which have troubleshooting and/or resolution suggestions. That EventID even has its own page on Technet, all official from from Microsoft itself.

---

Event ID 4005 — Windows Logon Availability

[...]

Diagnose

This error might be caused by one of the following conditions:

• System resources are inadequate or unavailable.
• The Windows registry is corrupted.
• A service failed to start.

To perform these procedures, you must have membership in Administrators, or you must have been delegated the appropriate authority.

[...]

---

Start there, do some troubleshooting, and see if you don't end up arriving at a solution.

Comments

[Sal]

No cant log in and the server log showed Winlogon errors but its vague...

[Sal]

I lowered the amount of RAM SQL uses but realistically the system had about 8 gigs on standby and 2-3 gigs totally free... dunno if that's gonna fix anything

[pauska]

Trust me, you're being more vague than the event logs are. Retrieve the errors, and post them in your question.

[Sal]

The Windows logon process has unexpectedly terminated. That is the exact error. Event ID 4005

[MichelZ]

Have you installed all recent updates?

[HopelessN00b]

@MichelZ reminds me that MS did issue an update that broke RDP a while back, specifically KB2667402. There are a bunch of fixes (or suggestions) online, though I believe that installing newer updates will successfully correct the issue (or has done so for me, so... anecdotal evidence).

[Sal]

Yes I always install any of the updates that are required or recommended. I'm checking to see if that KB MichelZ is installed.

[Sal]

Yep... it's installed :/

[Sal]

Ok so as per the articles I've uninstalled it, but cant reboot until the traffic is down later tonight... then I'll reinstall it. Thank you everyone who assisted me and fingers crossed and I'll keep everyone update :-)

[Sal]

And thank you HopelessN00b for the suggestion!!!!!

[Sal]

Thanks.. will do and will post my findings. This is a clean install too :/

[Hyppy]

What server log? Where was it located? How did you clear it?