Event ID - 20007

Event Id	20007
Source	RemoteAccess
Description	Cannot receive initial frame on port: %1 because of the following error: %2 The user has been disconnected.
Event Information	According to Microsoft : Cause : This event is logged when cannot receive initial frame on port because the user has been disconnected. Diagnose : The remote access connection must have permissions through dial-in properties of the user account and remote access policies. In addition, the credentials of the remote access client (user name, password, and domain name) must be validated by the remote access server. This error might be caused by the incorrect configuration of one of the following: Connection settings Credentials of the remote access client Check connection settings Match all of the conditions of at least one remote access policy. Grant remote access permission through the local user account (set to Allow access ). Or, you can grant remote access permission through the domain user account (set to Control access through NPS Network Policy) and the remote access permission of the matching remote access policy (set to Grant access ). Match all of the settings of the profile. Match all of the settings of the dial-in properties of the user account. Check the credentials of the remote access client in Windows or RADIUS If Windows is used as the authentication and accounting provider, the remote access server uses native Windows functions to validate the security credentials of the remote access client (typically, the remote access user's user name and password) and access the remote access client's user account dial-in properties. If RADIUS is used as the authentication and accounting provider, the remote access server acts as a RADIUS client and sends the user's credentials and other connection settings to a RADIUS server. The RADIUS server validates the credentials of the remote access client, authorizes the connection attempt, and stores remote access connection accounting information. Resolution : To resolve this issue,refer the mentioned link below.
Reference Links	Event ID 20007 from RemoteAccess How to configure remote access client account lockout in Windows Server 2003

Catch threats immediately

We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.

See what we caught