Event ID - 1036

Event Id1036
SourceMicrosoft-Windows-TerminalServices-RemoteConnectionManager
DescriptionTerminal Server session creation failed. The relevant status code was %1.
Event InformationAccording to Microsoft :
Cause :
This event is logged when terminal Server session creation failed.
Resolution :
Fix port assignment conflict
This problem could indicate that another application on the terminal server is using the same TCP port as the Remote Desktop Protocol (RDP). The default port assigned to RDP is 3389.
To resolve this issue, determine which application is using the same port as RDP. If the port assignment for that application cannot be changed, change the port assigned to RDP by editing the registry. After editing the registry, you must restart the Terminal Services service. After you restart the Terminal Services service, you should confirm that the RDP port has been correctly changed.
To perform these tasks, refer to the following sections.
Determine which application is using the same port as RDP
You can run the netstat tool to determine if port 3389 (or the assigned RDP port) is being used by another application on the terminal server.
To use netstat:
  1. On the terminal server, click Start, click Run, type cmd, and then click OK.
  2. At the command prompt, type netstat -a -o and then press ENTER.
  3. Look for an entry for TCP port 3389 (or the assigned RDP port) with a status of Listening. This indicates another application is using this port. The PID (Process Identifier) of the process or service using that port appears under the PID column.
To determine which application is using port 3389 (or the assigned RDP port), use the tasklist command-line tool along with the PID information from the netstat tool.
  1. On the terminal server, click Start, click Run, type cmd, and then click OK.
  2. Type tasklist /svc and then press ENTER.
  3. Look for an entry for the PID number that is associated with the port (from the netstat output). The services or processes associated with that PID will appear on the right.
Change the port assigned to RDP
You should determine if this application can use a different port. If you cannot change the application’s port, you will have to change the port assigned to RDP.
Important : Microsoft does not recommend changing the port assigned to RDP.
If you have to change the port assigned to RDP, you must edit the registry.
To perform this procedure, you must have membership in the local Administrators group, or you must have been delegated the appropriate authority.
To change the port assigned to RDP:
Caution : Incorrectly editing the registry might severely damage your system. Before making changes to the registry, you should back up any valued data.
  1. On the terminal server, open Registry Editor. To open Registry Editor, click Start, click Run, type regedit, and then click OK.
  2. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue.
  3. Locate and then click the following registry subkey:
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations
    Note : RDP-TCP is the default connection name. To change the port for a specific connection on the terminal server, select the connection under the WinStations key.
  4. In the right-pane, double-click the PortNumber registry entry.
  5. Type the port number that you want to assign to RDP in the Value data box. PortNumber is entered as a hexadecimal value.
  6. Click OK to save the change, and then close Registry Editor.
Restart the Terminal Services service
For the RDP port assignment change to take effect, stop and start the Terminal Services service.
To perform this procedure, you must have membership in the local Administrators group, or you must have been delegated the appropriate authority.
To stop and start the Terminal Services service:
  1. On the terminal server, open the Services snap-in. To open the Services snap-in, click Start, point to Administrative Tools, and then click Services.
  2. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue.
  3. In the Services pane, right-click Terminal Services, and then click Restart.
  4. If you are prompted about restarting other services, click Yes.
  5. Confirm that the Status column for the Terminal Services service displays Started.
Confirm that the RDP port has changed
To confirm that the RDP port assignment has been changed, use the netstat tool.
To use netstat:
  1. On the terminal server, click Start, click Run, type cmd, and then click OK.
  2. At the command prompt, type netstat -a and then press ENTER.
    Look for an entry for the port number that you assigned to RDP. The port should appear in the list and have a status of Listening.
Important : Remote Desktop Connection and the Terminal Server Web Client use port 3389, by default, to connect to a terminal server. If you change the RDP port on the terminal server, you will need to modify the port used by Remote Desktop Connection and the Terminal Server Web Client.
Verify :
To verify that the listener on the terminal server is working properly, use any of the following methods.
Note : RDP-TCP is the default connection name and 3389 is the default RDP port. Use the connection name and port number specific to your terminal server configuration.
Method one : Use an RDP client, such as Remote Desktop Connection, to establish a remote connection to the terminal server.
Method two :To use the qwinsta tool to view the listener status on the terminal server:
  1. On the terminal server, click Start, click Run, type cmd, and then click OK.
  2. At the command prompt, type qwinsta and then press ENTER.
  3. The RDP-TCP session state should be Listen.
Method three :To use the netstat tool to view the listener status on the terminal server:
  1. On the terminal server, click Start, click Run, type cmd, and then click OK.
  2. At the command prompt, type netstat -a and then press ENTER.
  3. The entry for TCP port 3389 should be Listening.
Method four :To use the telnet tool to connect to the RDP port on the terminal server:
  1. From another computer, click Start, click Run, type cmd, and then click OK.
  2. At the command prompt, type telnet servername 3389, where servername is the name of the terminal server, and then press ENTER.
    If telnet is successful, you will receive the telnet screen and a cursor.
    If telnet is not successful, you will receive this error:
    Connecting To servername...Could not open connection to the host, on port 3389: Connect failed
The qwinsta, netstat, and telnet tools are also included in Windows XP and Windows Server 2003. You can also download and use other troubleshooting tools, such as Portqry.
Reference LinksEvent ID 1036 from Source Microsoft-Windows-TerminalServices-RemoteConnectionManager

Catch threats immediately

We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.

See what we caught

Did this information help you to resolve the problem?

Yes: My problem was resolved.
No: The information was not helpful / Partially helpful.