Event ID 56

For Event ID 56 I got my information and step of resolution at the following sites

• http://www.kuskaya.info/2012/02/28/how-to-troubleshoot-the-terminal-server-security-layer-detected-an-error-in-the-protocol-stream-and-has-disconnected-the-client-client-ip-and-the-rdp-protocol-component-x/
• http://support.microsoft.com/kb/951037/en-us
• http://rcmtech.wordpress.com/2012/01/18/remote-desktop-the-local-security-authority-cannot-be-contacted/

Description

You may experience problems if you try to connect to a Windows Server 2008 R2 via RDP. The RDP protocol component X.224 detected an error in the protocol stream and has disconnected the client.

Symptoms

• RDP Session may freeze.
• Black screen inside RDP window.
• Slow connection.
• You may also be disconnected.

Solution

1) Configure TCP Chimney Offload in the operating system

• To disable TCP Chimney Offload, follow these steps
a. Use administrative credentials to open a command prompt.b. At the command prompt, type the following command, and then press ENTER: netsh int tcp set global chimney=disabled

2) Configure TCP Chimney Offload on the network adapter

• To determine the current status of TCP Chimney Offload, follow these steps:
a. Use administrative credentials to open a command prompt.b. At the command prompt, type the following command, and then press ENTER: netsh int tcp show global
• To determine the current status of TCP Chimney Offload, follow these steps:
a. Use administrative credentials to open a command prompt.b. At the command prompt, type the following command, and then press ENTER: netsh int tcp show global

3) Disable RSS in Windows Server 2008 R2

• To disable RSS, follow these steps:
a. Use administrative credentials to open a command prompt.a. At the command prompt, type the following command, and then press ENTER: netsh int tcp set global rss=disabled
• To determine the current status of RSS, follow these steps:
a. Use administrative credentials to open a command prompt.b. At the command prompt, type the following command, and then press ENTER: netsh int tcp show global

4) Disable NetDMA in Windows Server 2008 R2

• To disable NetDMA, follow these steps:
1. Click Start, click Run, type regedit, and then click OK.2. Locate the following registry subkey, and then click it:

3. Double-click the EnableTCPA registry entry.
• Note If this registry entry does not exist, right-click Parameters, point to New, click DWORD Value, type EnableTCPA, and then press ENTER.
4. To enable NetDMA, type 1 in the Value data box, and then click OK.5. To disable NetDMA, type 0 in the Value data box, and then click OK.6. If the EnableTCPA registry entry does not exist, enable the NetDMA functionality.