Unexpected Remote Desktop Protocol (RDP) logouts and disconnections can be difficult to diagnose in a multi-user Windows Server environment.

A user may report that:

• The Remote Desktop window suddenly closes.
• The user is unexpectedly returned to the login screen.
• Running applications close because the session was actually logged off.
• The user reconnects and discovers that applications are still running.
• The issue occurs only for one RDP user.
• Several users experience the issue around the same time.
• The problem occurs intermittently and cannot easily be reproduced.

The first task is to determine what actually happened to the RDP session.

An RDP window closing does not necessarily mean Windows logged the user off. The session may have been disconnected, terminated, logged off, reconnected, or interrupted by a network problem.

The examples below use fictional usernames, server names, paths, session IDs, timestamps, and network details so the procedures can safely be used in a public technical knowledge base.

1. RDP Disconnect vs. RDP Logoff

A disconnect and a logoff are different events.

RDP Disconnect

During a disconnect, communication between the RDP client and server stops, but the Windows session may remain active on the server.

Applications such as accounting software, Microsoft Excel, browsers, ERP software, and other business applications may continue running.

When the user reconnects, Windows may reconnect the user to the existing session.

Common causes include:

• Internet interruption
• Wi-Fi instability
• ISP packet loss
• VPN interruption
• RDP client closure
• Firewall timeout
• Router/NAT timeout
• Server network interruption
• Session policy

RDP Logoff

A logoff terminates the user's Windows session and normally closes applications running inside it.

Possible causes include:

• User selecting Sign out
• Administrator logging off the user
• Session timeout policy
• Remote Desktop Services policy
• Logoff script
• Scheduled task
• Third-party RDS software
• Server restart
• System failure
• Session-management software

Therefore, the first objective is:

Determine whether the user was disconnected or actually logged off.

2. Check the Current RDP Session with QUSER

One of the quickest ways to inspect Remote Desktop sessions is:

quser

To check a specific fictional user:

quser RDPUser01

Example:

USERNAME     SESSIONNAME    ID    STATE    IDLE TIME    LOGON TIME
rdpuser01    rdp-tcp#12     7     Active   .            15-Jul-26 10:20 AM

This output provides the username, session name, session ID, current state, idle time, and logon time.

STATE

Common values include:

Active
Disc

Active means the RDP session is currently connected.

Disc means the Windows session still exists on the server, but its RDP connection is disconnected.

3. QUSER Shows the Current State, Not the Full History

quser is useful for understanding what is happening now.

It does not tell you exactly what happened several hours earlier.

For example, a user may report:

"My RDP session automatically logged me out this afternoon."

When the administrator checks later:

quser RDPUser01

the session may simply show:

Active

Historical troubleshooting therefore requires Windows Event Logs.

4. Check the Terminal Services Local Session Manager Log

One of the most useful logs is:

Microsoft-Windows-TerminalServices-LocalSessionManager/Operational

Open:

Event Viewer
 → Applications and Services Logs
   → Microsoft
     → Windows
       → TerminalServices-LocalSessionManager
         → Operational

This log records important RDP session lifecycle events.

5. Important RDP Event IDs

Event ID 21 – Session Logon Succeeded

Indicates that a user successfully logged into an RDP session.

Example:

Session logon succeeded
User: CORP\RDPUser01
Session ID: 7

CORP, RDPUser01, and session ID 7 are fictional examples.

Event ID 22 – Shell Start Notification Received

This normally occurs after authentication when Windows begins starting the user's interactive desktop environment.

Event ID 23 – Session Logoff Succeeded

Event ID 23 indicates:

Session logoff succeeded

This is important because it indicates a session logoff rather than simply an RDP transport interruption.

However, Event 23 alone does not necessarily identify why the session was logged off.

Event ID 24 – Session Disconnected

Event ID 24 indicates that an RDP session was disconnected.

Possible causes include:

• Client closed Remote Desktop
• Internet interruption
• Wi-Fi problem
• Client PC sleep
• Router problem
• VPN interruption
• RDP transport failure

The user's Windows session may still be running.

Event ID 25 – Session Reconnection Succeeded

Event ID 25 indicates that an existing RDP session was successfully reconnected.

A sequence such as:

Event 24 – Session disconnected
Event 25 – Session reconnection succeeded

usually indicates that the original Windows session survived the interruption.

6. Query RDP Events with PowerShell

Open PowerShell as Administrator and run:

Get-WinEvent -LogName "Microsoft-Windows-TerminalServices-LocalSessionManager/Operational" |
Where-Object {
    $_.Id -in 21,22,23,24,25,41,42
} |
Select-Object TimeCreated, Id, Message |
Format-Table -Wrap

On a busy RDS server, this may return many records.

Filtering by user and date is therefore useful.

7. Filter Events for a Specific User

Use a fictional account such as:

RDPUser01

Example:

Get-WinEvent -LogName "Microsoft-Windows-TerminalServices-LocalSessionManager/Operational" |
Where-Object {
    $_.Message -match '(?i)\bRDPUser01\b'
} |
Sort-Object TimeCreated |
Select-Object TimeCreated, Id, Message |
Format-Table -Wrap

Replace RDPUser01 with the actual username only when running the command internally.

Do not publish the real username in screenshots, reports, or public knowledge-base articles.

8. Search Only Recent Events

For example, search the previous seven days:

$Start = (Get-Date).AddDays(-7)

Get-WinEvent -LogName "Microsoft-Windows-TerminalServices-LocalSessionManager/Operational" |
Where-Object {
    $_.TimeCreated -ge $Start -and
    $_.Message -match '(?i)\bRDPUser01\b'
} |
Sort-Object TimeCreated |
Select-Object TimeCreated, Id, Message |
Format-Table -Wrap

This produces a chronological history of recent activity for the selected RDP user.

9. Example of an Anonymized Session Timeline

Consider this fictional example:

10:20:11 AM – Session logon succeeded
10:20:13 AM – Shell start notification received

03:15:42 PM – Session disconnected
03:15:50 PM – Session reconnection succeeded

06:25:18 PM – Session logoff succeeded

At 3:15 PM, the session disconnected.

Eight seconds later, the same session reconnected.

This suggests a temporary connection interruption.

Later:

06:25:18 PM – Session logoff succeeded

Windows recorded an actual session logoff.

The two incidents should therefore be investigated separately.

10. Check Windows Security Events

Useful Security Event IDs include:

Event ID	Meaning
4624	Successful logon
4634	Account logged off/session ended
4647	User initiated logoff
4778	RDP session reconnected
4779	RDP session disconnected

These events can be correlated with Terminal Services events.

11. Search Security Events with PowerShell

$Start = (Get-Date).AddDays(-7)

Get-WinEvent -LogName Security -ErrorAction SilentlyContinue |
Where-Object {
    $_.TimeCreated -ge $Start -and
    $_.Id -in 4624,4634,4647,4778,4779 -and
    $_.Message -match '(?i)\bRDPUser01\b'
} |
Sort-Object TimeCreated |
Select-Object TimeCreated, Id,
@{N='Meaning';E={
    switch ($_.Id) {
        4624 {'Logon'}
        4634 {'Logoff / session ended'}
        4647 {'User initiated logoff'}
        4778 {'RDP reconnected'}
        4779 {'RDP disconnected'}
    }
}} |
Format-Table -AutoSize

Replace:

RDPUser01

with the actual account when performing the investigation.

12. What If the Security Query Returns No Results?

A blank result does not prove that no RDP event occurred.

Possible reasons include:

• Required auditing was not enabled.
• Older events were overwritten.
• The username is represented differently.
• The filter did not match the event message.
• The relevant auditing subcategory was not configured.
• The Security log does not contain the evidence needed for that incident.

Check the Terminal Services Operational log as well.

13. Security Event ID 4647

Event ID:

4647

means:

User initiated logoff

If Event 4647 appears immediately before session termination, Windows recorded a user-initiated sign-out action.

It should still be correlated with:

23
24
25
4634
4778
4779

as well as the session ID and timestamps.

14. Check Whether Multiple Users Were Affected

Suppose RDPUser01 reports a problem around:

03:15 PM

Check all relevant RDP events around that period.

Example:

$Start = Get-Date "2026-07-15 15:10"
$End   = Get-Date "2026-07-15 15:20"

Get-WinEvent -LogName "Microsoft-Windows-TerminalServices-LocalSessionManager/Operational" |
Where-Object {
    $_.TimeCreated -ge $Start -and
    $_.TimeCreated -le $End -and
    $_.Id -in 21,22,23,24,25,41,42
} |
Sort-Object TimeCreated |
Select-Object TimeCreated, Id, Message |
Format-Table -Wrap

The date and time above are fictional.

Use the actual incident period when troubleshooting.

If several users show disconnects during the same few minutes, investigate shared infrastructure.

15. One User vs. Multiple Users

Only One User Is Affected

Investigate:

• User profile
• User-specific Group Policy
• Logon/logoff scripts
• Session timeout
• Account restrictions
• Client computer
• Local Internet connection
• RDP client
• Credential/session conflicts

Multiple Users Are Affected Simultaneously

Investigate:

• RDS services
• Server resources
• Network adapter
• Firewall
• Internet/WAN connection
• Hypervisor
• Virtual machine host
• Scheduled tasks
• Group Policy
• Server restart
• Security software
• Third-party session-management software

16. Check Group Policy Session Limits

Open:

gpedit.msc

Navigate to:

Computer Configuration
 → Administrative Templates
   → Windows Components
     → Remote Desktop Services
       → Remote Desktop Session Host
         → Session Time Limits

Review:

Set time limit for disconnected sessions

Set time limit for active but idle Remote Desktop Services sessions

Set time limit for active Remote Desktop Services sessions

End session when time limits are reached

A configured session limit can cause predictable session termination.

17. Check Effective Group Policy

Domain policies can override local configuration.

Generate a report:

gpresult /h C:\Temp\RDS-GPReport.html

Open the report and review policies affecting:

• Remote Desktop Services
• Session limits
• Logon/logoff scripts
• User configuration
• Computer configuration
• Security settings

RDS-GPReport.html is simply an example report name.

18. Check Scheduled Tasks

A scheduled task may run a script or application that resets or terminates RDP sessions.

Open:

taskschd.msc

Or use:

Get-ScheduledTask |
Select-Object TaskName, TaskPath, State |
Sort-Object TaskPath, TaskName

Look particularly for custom tasks involving:

logoff
session
RDP
cleanup
idle
restart
maintenance

19. Check Third-Party RDS Software Carefully

Some servers use third-party Remote Desktop or session-management platforms.

These products may integrate with:

• User authentication
• Session creation
• Winlogon
• Logon scripts
• Session monitoring
• Session termination

When such software is installed, investigate its own event logs and configuration in addition to Windows logs.

Do not remove an unfamiliar component simply because it appears in the Windows logon process.

20. Check Winlogon Configuration

An administrator may inspect:

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

Important values can include:

Userinit
Shell
AppSetup

A typical Windows Userinit value contains:

C:\Windows\system32\userinit.exe,

Third-party session-management products may add their own components.

For documentation purposes, use a fictional example such as:

C:\Windows\system32\userinit.exe,C:\Program Files\RemoteSessionAgent\SessionAgent.exe,

This path is an illustrative example only and does not represent a real production configuration.

21. Verify an Unknown Executable Before Changing Anything

For example:

Get-AuthenticodeSignature "C:\Program Files\RemoteSessionAgent\SessionAgent.exe"

You can also inspect file metadata:

Get-Item "C:\Program Files\RemoteSessionAgent\SessionAgent.exe" |
Select-Object Name, Length, CreationTime, LastWriteTime, VersionInfo

Do not delete or modify a Winlogon component until its purpose and origin are established.

Incorrect Winlogon modifications can prevent users from signing in.

22. Check Logon Scripts

For illustration, suppose AppSetup references:

CompanyLogon.cmd

Inspect the actual script in the production environment and look for commands such as:

logoff
shutdown
taskkill
tsdiscon
rwinsta
reset session

The existence of a logon script alone does not prove it caused the problem.

23. Check Whether the Server Restarted

A server reboot will terminate active sessions.

Review System events including:

1074
6005
6006
6008
41

Common interpretations:

1074 – A process or user initiated a planned shutdown/restart.

6005 – Event Log service started, commonly associated with startup.

6006 – Event Log service stopped, commonly associated with a clean shutdown.

6008 – Previous shutdown was unexpected.

41 – Kernel-Power event associated with an unexpected restart or shutdown condition.

Correlate these events with the reported RDP incident time.

24. Check Server Resource Utilization

Monitor:

• CPU
• RAM
• Disk latency
• Page file
• Network utilization
• RDS services
• Application resource consumption

Useful Windows tools include:

Task Manager
Resource Monitor
Performance Monitor
Event Viewer
PowerShell

Resource pressure can cause severe RDP lag and instability, but high utilization alone does not prove that it caused a session logoff.

25. Investigate Network Problems Separately

A network problem commonly causes a disconnect rather than an immediate clean Windows logoff.

For example:

03:15:42 PM – Event 24 – Session disconnected
03:15:50 PM – Event 25 – Session reconnected

This pattern points toward a temporary connectivity interruption.

Possible causes include:

• Packet loss
• ISP instability
• Wi-Fi issue
• Router problem
• Firewall timeout
• VPN interruption
• WAN failover
• Lease-line interruption
• Client-side Internet problem

This is fundamentally different from:

06:25:18 PM – Event 23 – Session logoff succeeded

26. Build an Incident Timeline Before Making Changes

For example:

02:58 PM – User working normally
03:15 PM – Session disconnected
03:15 PM – Other users also disconnected
03:16 PM – Session reconnected
03:22 PM – Another session logged off

Then determine:

• Was only one user affected?
• Were several users affected?
• Was it a disconnect or logoff?
• Did the same session reconnect?
• Did the server restart?
• Did a scheduled task execute?
• Did the network fail?
• Did session-management software generate an event?

This evidence-based process reduces unnecessary configuration changes.

27. Recommended Troubleshooting Workflow

Step 1 – Check Current Sessions

quser

Record:

Username
Session ID
State
Idle Time
Logon Time

Step 2 – Check Local Session Manager Events

Review:

21
22
23
24
25
41
42

Step 3 – Build the User's Timeline

Filter by username and sort events chronologically.

Step 4 – Check Security Events

Investigate:

4624
4634
4647
4778
4779

Step 5 – Compare Other Users

Review the same incident window across all RDP sessions.

Step 6 – Check Session Policies

Review effective RDS session timeout policies.

Step 7 – Check Scheduled Tasks and Scripts

Identify automated maintenance, cleanup, disconnect, or logoff actions.

Step 8 – Check Third-Party Session Software

Review installed RDS/session-management platforms and their logs.

Step 9 – Check Server-Level Events

Look for server restarts, service failures, resource problems, network adapter problems, and hypervisor events.

Step 10 – Check Network Conditions

Prioritize network troubleshooting when Event 24 is followed by Event 25 without evidence of an actual session termination.

28. Quick Interpretation Table

Evidence	Likely Interpretation
Event 24	RDP session disconnected
Event 24 → Event 25	Temporary disconnect followed by reconnection
Event 23	Session logged off
Event 4647	User-initiated logoff recorded
Event 4779	RDP session disconnected
Event 4778	Existing RDP session reconnected
Many users disconnect together	Shared network/server/infrastructure issue
One user repeatedly logs off	User-specific policy/profile/session issue
Server restart events	Restart likely terminated sessions
Consistent idle-time pattern	Investigate RDS session timeout policies

29. Security and Privacy When Publishing Troubleshooting Logs

Before publishing screenshots, PowerShell output, or Event Viewer data, anonymize:

• RDP usernames
• Administrator usernames
• Server names
• Domain names
• Public IP addresses
• Internal IP addresses where unnecessary
• Computer names
• Customer/company names
• Session IDs when they identify a specific incident
• Email addresses
• Phone numbers
• File paths containing usernames or company names
• VPN details
• Firewall hostnames
• Exact production timestamps where disclosure is unnecessary

For example:

Actual username → RDPUser01
Actual server → RDS-SERVER01
Actual domain → CORP
Actual client → CLIENT-PC01
Actual public IP → 203.0.113.25

The documentation can retain its technical value without exposing production infrastructure.

30. Conclusion

Unexpected RDP logout problems should be investigated through event correlation rather than assumptions.

Start with:

quser

Then investigate:

TerminalServices-LocalSessionManager/Operational
Security
System
Group Policy
Scheduled Tasks
Third-party RDS/session software
Network connectivity

Pay particular attention to:

21 – Logon succeeded
22 – Shell started
23 – Logoff succeeded
24 – Session disconnected
25 – Session reconnected
4624 – Successful logon
4634 – Logoff/session ended
4647 – User initiated logoff
4778 – RDP reconnected
4779 – RDP disconnected

Most importantly, determine whether one user or multiple users were affected at approximately the same time.

A single-user issue may point toward the user's profile, client connection, account configuration, or user-specific policy.

A simultaneous multi-user issue should shift the investigation toward shared infrastructure such as the RDS server, network, firewall, hypervisor, Group Policy, scheduled maintenance, or session-management platform.

Building an accurate timeline before changing the server provides a much safer and more reliable method of identifying the root cause.

FAQ

1. What is the difference between RDP disconnect and logoff?

A disconnect breaks the Remote Desktop connection while the Windows session may remain running. A logoff terminates the Windows session and normally closes its applications.

2. How do I check currently logged-in RDP users?

Run:

quser

For a specific account:

quser RDPUser01

3. Which event indicates an RDP disconnect?

Terminal Services Local Session Manager Event ID 24 indicates a session disconnect.

4. Which event indicates an RDP reconnection?

Event ID 25 indicates a successful session reconnection.

5. Which event indicates an RDP logoff?

Event ID 23 indicates that the session logoff succeeded.

6. What does Security Event ID 4647 mean?

It indicates that Windows recorded a user-initiated logoff.

7. What does Event ID 4779 mean?

It indicates that an RDP session was disconnected.

8. What does Event ID 4778 mean?

It indicates that an existing RDP session was reconnected.

9. Can an Internet problem cause RDP to disconnect?

Yes. Packet loss, ISP problems, Wi-Fi instability, VPN failures, firewall timeouts, and WAN interruptions can disconnect RDP.

10. Does an RDP disconnect close running applications?

Normally no. The Windows session can remain active and applications may continue running.

11. Can Group Policy automatically terminate an RDP session?

Yes. RDS Session Time Limits can control active, idle, and disconnected sessions.

12. Can a scheduled task cause an RDP logout?

Yes. A custom task or maintenance script could execute commands that terminate sessions.

13. Why should other users' events be checked?

Simultaneous incidents across multiple users can reveal a shared server, network, policy, or infrastructure problem.

14. Can third-party RDS software affect session behavior?

Yes. Session-management software can participate in authentication, logon, reconnection, timeout, and session termination.

15. Should an unfamiliar Winlogon executable be deleted?

No. Verify its origin, signature, and purpose before making changes. Removing a legitimate Winlogon component can prevent users from signing in.

16. Why might the Security Event query return nothing?

Auditing may not have generated the required records, logs may have been overwritten, or the filtering criteria may not match how the account is represented.

17. Can high CPU or RAM usage cause RDP problems?

Resource exhaustion can cause lag, freezing, timeouts, and instability, but it should not be identified as the cause of a logoff without supporting evidence.

18. How can I check whether the server restarted?

Review System events such as 1074, 6005, 6006, 6008, and Kernel-Power 41 around the incident time.

19. What should be investigated when several users disconnect simultaneously?

Check server networking, WAN/Internet connectivity, firewall, RDS services, hypervisor, VM host, server resources, scheduled maintenance, Group Policy, and third-party session software.

20. What information should be removed before publishing RDP logs?

Remove or replace usernames, server names, customer names, domain names, IP addresses, email addresses, phone numbers, sensitive paths, infrastructure identifiers, and other information that could identify the production environment.

 

#WindowsServer #WindowsServer2019 #RDP #RemoteDesktop #RemoteDesktopServices #RDS #RDPServer #RDPTroubleshooting #WindowsTroubleshooting #ServerTroubleshooting #SystemAdministrator #SysAdmin #WindowsAdmin #ITSupport #ITEngineer #TechnicalSupport #PowerShell #PowerShellAdmin #GetWinEvent #Quser #EventViewer #WindowsEventViewer #SecurityLog #WindowsSecurity #EventID23 #EventID24 #EventID25 #EventID4647 #EventID4778 #EventID4779 #RDPDisconnect #RDPLogout #RDPReconnect #RDPSession #SessionTimeout #GroupPolicy #RDSGroupPolicy #WindowsGPO #SessionManagement #RemoteAccess #NetworkTroubleshooting #ServerAdministration #ServerMonitoring #ITInfrastructure #TerminalServices #RemoteDesktopSession #WindowsSupport #RootCauseAnalysis #RDSAdmin #KnowledgeBase