To collect Windows-TerminalServices-RemoteConnectionManager/Operational, add the following to a inputs.conf
We've found that multiline data parses better natively without having to create a props/transforms.
[WinEventLog://Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational]
disabled = False
renderXml = False
index = win
What eventID's are in Microsoft-Windows-TerminalServices-RemoteConnectionManager?
PS C:\Users\Administrator> (Get-WinEvent -ListProvider Microsoft-Windows-TerminalServices-RemoteConnectionManager).Events | Format-Table Id, Description
Id Description
-- -----------
2 %1
3 %1
4 %1
5 %1
6 %1
7 %1
8 %1
9 %1
256 Remote Desktop Services Remote Connection Manager is starting up
257 Remote Desktop Services Remote Connection Manager has finished start up. Return code %1
258 Listener %1 has started listening
259 Listener %1 has stopped listening
260 Listener %1 failed while listening. Error code %2
261 Listener %1 received a connection
262 Listener %1 has been asked to stop listening
1003 The remote desktop client '%1' has provided an invalid license.
1004 The Remote Desktop Session Host server cannot issue a client license. It was unable to issue the license due to a changed (mismatched) client license, insufficient memory, or an internal error. Further details for this problem may have been reported at th...
1006 The RD Session Host server received large number of incomplete connections. The system may be under attack.
1011 The remote session could not be established from remote desktop client %1 because its temporary license has expired.
1073742836 Remote session from client name %1 exceeded the maximum allowed failed logon attempts. The session was forcibly terminated.
3221226494 TermService clustering failed to redirect a client to an alternate clustered server, ntstatus=%1.
3221226496 TermService clustering failed to initialize because the Session Directory Provider failed to initialize, hresult=%1.
3221226500 The remote session could not be established from remote desktop client %1 because its license could not be renewed.
3221226507 RD Session Host Server listener stack was down. The relevant status code %1.
3221226508 RD Session Host Server session creation failed. The relevant status code was %1.
3221226513 Autoreconnect failed to reconnect user to session because authentication failed. (%1)
3221226515 The Remote Desktop Session Host server cannot communicate with the Remote Desktop license server %1. Ensure that the computer account for the Remote Desktop Session Host server is a member of the RDS Endpoint Servers group on the license server.
3221226518 Failed to load RD Session Host Server Profile path. Note that the profile path must be less than 256 characters in length. User Name: %1 Domain: %2
3221226522 The RD Session Host Server listener %1 is configured with inconsistent authentication and encryption settings. The Encryption Level is currently set to %2 and Security Layer is set to %3. These settings were automatically corrected to allow connections to ...
3221226523 The RD Session Host Server is configured to use SSL with user selected certificate, however, no usable certificate was found on the server. The default certificate will be used for RD Session Host Server authentication from now on. Please check the securit...
3221226524 The RD Session Host Server is configured to use a certificate that will expire in %2 days. %1 The SHA1 hash of the certificate is in the event data. Please check the security settings by using the Remote Desktop Session Host Configuration tool in the Admin...
3221226525 The RD Session Host Server is configured to use a certificate that is expired. %1 The SHA1 hash of the certificate is in the event data. The default certificate will be used for RD Session Host Server authentication from now on. Please check the security s...
3221226526 The RD Session Host Server is configured to use a certificate that does not contain an Enhanced Key Usage attribute of Server Authentication. %1 The SHA1 hash of the certificate is in the event data. The default certificate will be used for RD Session Host...
3221226527 The RD Session Host Server is configured to use a certificate but is unable to access the private key associated with this certificate. %1 The SHA1 hash of the certificate is in the event data. The default certificate will be used for RD Session Host Serve...
3221226528 A new self signed certificate to be used for RD Session Host Server authentication on SSL connections was generated. The name on this certificate is %1. The SHA1 hash of the certificate is in the event data.
3221226529 The RD Session Host Server has failed to create a new self signed certificate to be used for RD Session Host Server authentication on SSL connections. The relevant status code was %1.
3221226530 The RD Session Host Server has failed to replace the expired self signed certificate used for RD Session Host Server authentication on SSL connections. The relevant status code was %1.
3221226531 The RD Session Host Server authentication certificate configuration data was invalid and the service reset it. If the computer was configured to use a specific certificate, please verify it is available in the certificate store and use the administrative t...
3221226532 The Remote Desktop Services User Home Directory was not set because the path specified does not exist or not accessible. The default Home Directory Path was used instead. User Name: %1 Domain: %2
3221226533 Remote Desktop Session Host server was unable to retrieve users Licensing information from AD. Error %1
3221226534 The RD Session Host server is configured to use a template-based certificate for Transport Layer Security (TLS) 1.0\Secure Sockets Layer (SSL) authentication and encryption, but the subject name on the certificate is invalid. %1 The SHA1 hash of the certif...
3221226535 A new template-based certificate to be used by the RD Session Host server for Transport Layer Security (TLS) 1.0\Secure Sockets Layer (SSL) authentication and encryption has been installed. The name for this certificate is %1. The SHA1 hash of the certific...
3221226536 The RD Session Host server cannot install a new template-based certificate to be used for Transport Layer Security (TLS) 1.0\Secure Sockets Layer (SSL) authentication and encryption. The following error occured: %1.
3221226537 The template-based certificate that is being used by the RD Session Host server for Transport Layer Security (TLS) 1.0\Secure Sockets Layer (SSL) authentication and encryption has expired and cannot be replaced by the RD Session Host server. The following ...
3221226538 RD Session Host Server was unable to process session arbitration request. Error %1
3221226539 The RD Session Host server cannot register 'TERMSRV' Service Principal Name to be used for server authentication. The following error occured: %1.
1068 The RD Licensing mode has not been configured.
1069 The RD Licensing grace period has expired and Licensing mode for the Remote Desktop Session Host server has not been configured. Licensing mode must be configured for continuous operation.
3221226542 A logon request was denied because the RD Session Host server is currently in drain mode and therefore not accepting new user logons. To configure the server to allow new user logons, use the Remote Desktop Services Configuration tool.
3221226543 A connection request was denied because the RD Session Host server is currently configured to not accept connections. To configure the server to allow connections, use the chglogon command-line tool.
3221226600 The RD Licensing grace period has expired and the service has not registered with a license server with installed licenses. A RD Licensing server is required for continuous operation. A Remote Desktop Session Host server can operate without a license serve...
3221226601 The RD Licensing grace period is about to expire on %1 and the service has not registered with a license server with installed licenses. A RD Licensing server is required for continuous operation. A Remote Desktop Session Host server can operate without a ...
3221226602 The Remote Desktop Session Host server does not have a Remote Desktop license server specified. To specify a license server for the Remote Desktop Session Host server, use the Remote Desktop Session Host Configuration tool.
3221226603 The Remote Desktop Session Host server could not contact the Remote Desktop license server %1. Ensure that the Remote Desktop Licensing service is running on the license server, that the license server is accepting network requests, and that the license se...
3221226604 The Remote Desktop license server %1 does not support the version of the operating system running on the Remote Desktop Session Host server.
3221226605 The certificate issued by the Remote Desktop license server to the Remote Desktop Session Host server is not valid. The license server will not issue Remote Desktop Services client access licenses to clients connecting to the Remote Desktop Session Host se...
1136 RD Session Host Server role is not installed.
1137 The roaming user profile cache manager for Remote Desktop Services could not start. Error Code: %1
1138 The roaming user profile cache manager for Remote Desktop Services could not start because an incorrect value was specified for the monitoring interval. Error Code: %1
1139 The roaming user profile cache manager for Remote Desktop Services could not start because an incorrect value was specified for the maximum cache size. Error Code: %1
1140 The "Limit the size of the entire roaming user profile cache" Group Policy setting has been enabled, but the roaming user profile cache manager for Remote Desktop Services has encountered a problem. Error Code: %1
1141 The "Limit the size of the entire roaming user profile cache" Group Policy setting has been disabled, but the roaming user profile cache manager for Remote Desktop Services has encountered a problem. Error Code: %1
1142 The "Limit the size of the entire roaming user profile cache" Group Policy setting has been enabled.
1143 The "Limit the size of the entire roaming user profile cache" Group Policy setting has been disabled.
1144 The roaming user profile cache manager for Remote Desktop Services could not delete the roaming user profile for the user %1. The roaming user profile cache might still exceed the %2 gigabyte limit. Error Code: %3
1145 The roaming user profile cache manager for Remote Desktop Services deleted the roaming user profile for the user %1 because the roaming user profile cache exceeded the %2 gigabyte limit.
1146 Remote Desktop Services: Remote control session initiated:...
1147 Remote Desktop Services: Remote control session connection succeeded:...
1148 Remote Desktop Services: Remote control session connection failed:...
1149 Remote Desktop Services: User authentication succeeded:...
1150 Remote Desktop Services: User config data have been merged:...
1151 The remote user's connection was declined by the logged on user....
1152 Failed to create KVP sessions string. Error Code %1
3221226624 The Remote Desktop Virtualization Host server cannot issue a client license. It was unable to issue the license due to a changed (mismatched) client license, insufficient memory, or an internal error. Further details for this problem may have been reporte...
1153 Failed to write KVP sessions string. Error Code %1
3221226625 The RD Licensing grace period has expired and Licensing mode for the Remote Desktop Virtualization Host server has not been configured. Licensing mode must be configured for continuous operation.
3221226626 The RD Licensing grace period has expired and the service has not registered with a license server with installed licenses. A RD Licensing server is required for continuous operation. A Remote Desktop Virtualization Host server can operate without a licens...
1155 The Remote Connection Manager selected Kernel mode RDP protocol stack.
3221226627 The RD Licensing grace period is about to expire on %1 and the service has not registered with a license server with installed licenses. A RD Licensing server is required for continuous operation. A Remote Desktop Virtualization Host server can operate wit...
1156 The Remote Connection Manager selected User mode RDP protocol stack.
3221226628 The Remote Desktop Virtualization Host server does not have a Remote Desktop license server specified. To specify a license server for the Remote Desktop Virtualization Host server, use the RDS module for Windows PowerShell.
1157 The listener named %1 has modified some configuration settings.
3221226629 The Remote Desktop Virtualization Host server could not contact the Remote Desktop license server %1. Ensure that the Remote Desktop Licensing service is running on the license server, that the license server is accepting network requests, and that the lic...
1158 Remote Desktop Services accepted a connection from IP address %1.
3221226630 The Remote Desktop license server %1 does not support the version of the operating system running on the Remote Desktop Virtualization Host server.
3221226631 The certificate issued by the Remote Desktop license server to the Remote Desktop Virtualization Host server is not valid. The license server will not issue licenses to clients connecting to the Remote Desktop Virtualization Host server. To resolve this is...
3221226632 The Remote Desktop Virtualization Host server cannot communicate with the Remote Desktop license server %1. Ensure that the computer account for the Remote Desktop Virtualization Host server is a member of the RDS Endpoint Servers group on the license server.
1280 Remote Desktop Configuration service could not remove user %1\%2 from administrators group, error Code: %3
1281 Remote Desktop Configuration service could not remove user %1\%2 from Remote Desktop Users group, error Code: %3
1282 Remote Desktop Configuration service could not remove user with SID %1 from administrators group, error Code: %2
1283 Remote Desktop Configuration service could not remove user with SID %1 from Remote Desktop Users group, error Code: %2
1284 Remote Desktop Configuration service has added user %1\%2 to administrators group
1285 Remote Desktop Configuration service has added user %1\%2 to Remote Desktop Users group
1286 Remote Desktop Configuration service has removed user with SID %1 from administrators group
1287 Remote Desktop Configuration service has removed user with SID %1 from Remote Desktop Users group
1288 Remote Desktop Configuration service has removed user %1\%2 from administrators group
1289 Remote Desktop Configuration service has removed user %1\%2 from Remote Desktop Users group
2304
2305
2306
2307
20480 Remote Desktop Services Network Fair Share started.
20481 Remote Desktop Services Network Fair Share stopped.
20482 Remote Desktop Services Network Fair Share was enabled for the user account %1 with a weight of %2.
20483 Remote Desktop Service Network Fairshare has been enabled for connection on session %1 with weight of %2.
20484 Remote Desktop Services could not enable Network Fair Share for the user account %1. The error code is %2.
20485 Remote Desktop Services could not enable Network Fair Share for the connection on session %1. The error code is %2.
20486 Remote Desktop Services could not enable Network Fair Share for session %1. The error code is %2.
20487 Remote Desktop Services Network Fair Share was disabled for the user account %1.
20488 Remote Desktop Services Network Fair Share was disabled for the connection on session %1.
20489 Remote Desktop Services could not disable Network Fair Share for the user account %1. The error code is %2.
20490 Remote Desktop Services could not disable Network Fair Share for the connection on session %1. The error code is %2.
20491 Remote Desktop Services could not disconnect a user disk for the user account with a SID of %1. The error code is %2.%3
20492 Remote Desktop Services could not detach a user disk for the user account with a SID of %1. The error code is %2.%3
20493 Remote Desktop Services could not apply a user desktop for a user account with a SID of %1. A temporary profile was enforced for the user. Verify that the user profile disk settings are correct. The error code is %2.%3
20494 Remote Desktop Services could not obtain a user profile disk for the user account with a SID of %1. Verify that the user profile disk location is accessible, the server's computer account has read and write permissions to it, and that the location has a us...
20495 Remote Desktop Services could not attach a user profile disk for a user account with a SID of %1. The error code is %2.%3
20496 Remote Desktop Services could not apply a user desktop for a user account with a SID of %1. A temporary profile could not be enforced for the user. The user will get a normal profile, and the user's state will be discarded when the user logs off. Verify th...
20497 The RD Licensing has taken too long to process the client license
20498 Remote Desktop Services has taken too long to complete the client connection
20499 Remote Desktop Services has taken too long to load the user configuration from server %1 for user %2
20500 Remote Desktop Services took %3 milliseconds to load the user configuration from server %1 for user %2
20501 Remote Desktop Services failed to shutdown within the time allocated
20502 Remote Desktop Services failed to retrieve information about a connection for session %1 within the time allocated
20503 Shadow View Session Started...
20504 Shadow View Session Stopped...
20506 Shadow Control Session Started...
20507 Shadow Control Session Stopped...
20508 Shadow View Permission Granted...
20509 Shadow View Permission Denied...
20510 Shadow Control Permission Granted...
20511 Shadow Control Permission Denied...
20512 Shadow Session Failure...
20513 Shadow Session Failure...
20514 Shadow Session Failure...
20515 Session %1 has been idle over its time limit, and was logged off
20516 Session %1 has been idle over its time limit, and was disconnected
20517 Session %1 has exceeded its time limit, and was logged off
20518 Session %1 has exceeded its time limit, and was disconnected
20519 Session %1 has exceeded its disconnect time limit, and was logged off
20520 User config info will be loaded from domain controller for this %1 connection
20521 User config info will be loaded from local machine for this %1 connection
20522 Shadow Session Clipboard Copy Request...