| Event Id | 1041 |
| Source | Microsoft-Windows-TerminalServices-RemoteConnectionManager |
| Description | Autoreconnect failed to reconnect user to session because authentication failed. |
| Event Information | According to Microsoft : Cause : This event is logged when autoreconnect failed to reconnect user to session. Resolution : Establish a new connection to the terminal server To resolve this issue, establish a new connection to the terminal server by using a Remote Desktop Protocol (RDP) client such as Remote Desktop Connection. When a client computer tries to reestablish a remote session with the terminal server after a temporary network interruption, the client computer attempts to authenticate with the terminal server. If the information passed between the client computer and the terminal server to reestablish the connection has become corrupted, the client computer will not be able to reestablish the remote session. The Remote Desktop Connection client will automatically try to reconnect the remote session with the terminal server if the Reconnect if connection is dropped check box is selected on the Experience tab of the Remote Desktop Connection client. Important: If there are numerous events in the event log indicating that user authentication failed, it is possible that a malicious attempt is being made to gain access to the terminal server. To perform this procedure, you must have membership in the local Administrators group, or you must have been delegated the appropriate authority. To check which users are connected to the terminal server: 1.On the terminal server, click Start, point to Administrative Tools, point to Terminal Services, and then click Terminal Services Manager. 2.If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue. 3.On the Users tab, the users that are connected to the terminal server are listed. Ensure that there are no suspicious accounts listed. Verify : To verify that connections to the terminal server are working properly, establish a remote session with the terminal server. |
| Reference Links | Event ID 1041 from Source Microsoft-Windows-TerminalServices-RemoteConnectionManager |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.