Event ID: 1006 and multiple login screens

Hi all

Does anyone have any insight into what triggers Event ID 1006 and if
there is a way to turn this feature off?

I've set up a couple of Windows Terminal Services 2003 environments
using Sun Ray thin clients and rdesktop. The nature of the Sun Ray
architecture is that the thin clients are just dumb graphics and I/O
devices for the central Sun Ray server. This means that from the
Windows point of view, the Sun Ray server is making multiple RDP
connections from the same IP address.

It all works fine except for the "Event ID: 1006" problem. This occurs
when I attempt to have multiple thin clients showing the
username/password login screen at the same time. On the attempt to show
the 46th simultaneous username/password screen, Windows kills that RDP
connection and records Event ID 1006 in the system log. Further
attempts to connect using RDP fail for the next 60 seconds or so. The
rdesktop error is "Connection reset by peer".

"The terminal server received large number of incomplete connections.
The system may be under attack."

Interestingly, the number of successfully logged-in connections is
irrelevant. The only thing that seems to be counted is the number of
simultaneous username/password login screens. That is, I can have e.g.
5 users logged in, and 45 thin clients showing the login screen, and
then the attempt to bring up a 46th login screen fails.

This is not an rdesktop problem - I have reproduced this problem using
the Windows Remote Desktop client as well. The error is "The client
could not establish a connection to the remote computer. Attempting to
connect to 46 username/password login screens from the same Windows
machine - 45 are successful, the 46th attempt fails. Once again,
successfully logged-in sessions don't seem to count towards this
figure.

This is not a licensing problem - one environment I've set up is using
per-device licenses, the other is using per-user licenses. The licenses
are valid and there are enough of them.There are no licensing errors in
the Windows event log.

It is unlikely that I will have 45 users simultaneously trying to type
in their username and password, but it's a potential issue and I'd like
to know if my analysis of what triggers it is correct or not. Anyone
know some details on this?

Regards
Tom Shaw

.

Relevant Pages

  • Re: Event ID: 1006 and multiple login screens
    ... > This means that from the Windows point of view, ... > server is making multiple RDP connections from the same IP ... > number of simultaneous username/password login screens. ... > using per-device licenses, the other is using per-user licenses. ...
    (microsoft.public.windows.terminal_services)
  • Re: windows xp home edition taking ages to boot up
    ... access the net on the laptop my pc popped up with a windows message ... internet as well as giving network access to your daughter. ... that in network connections you have 1 local area connection is that ... You can access Event Viewer by selecting Start, ...
    (microsoft.public.windowsxp.help_and_support)
  • RE: Network Path Lost
    ... Windows Update web page. ... By Default windows XP limits Max. TCP connections to 10 at one time. ... SynAttackProtect is set to 1, ensure that this value is lower than the AFD ...
    (microsoft.public.windowsxp.network_web)
  • Re: winsock error 10060
    ... How to determine and to recover from Winsock2 corruption in Windows ... third-party add-ons hooking up on your beowser and causing the timing out! ... Connections>> Double click Internet Options, ... Click on General Tab and you will see a Button ...
    (microsoft.public.windowsxp.general)
  • RE: Windows CE Term Serv Client (RDP) not reading password from RDP Fi
    ... AutoLogon is disabled by default. ... thin clients, you can set the WBT build variable WBT_USEAUTOLOGON to allow ... If AutoLogon is disabled by default in your run-time image, ... I have tried a paid incident from Microsoft to find out that Windows CE is ...
    (microsoft.public.windowsce.embedded)
Loading