Troubleshoot RDP auto-disconnection with logon/logoff records in system logs

Updated at:
Copy as MD

Resolve RDP auto-disconnection on a Windows ECS instance where the connection drops after password entry but logon/logoff records appear in system logs.

Problem description

When you use RDP to connect to a Windows ECS instance, the connection drops after you enter the password. However, logon and logoff records for this connection appear in the system logs.

See View system logs and screenshots.

Causes

The WUDFHost.exe process calls C:\Windows\System32\drivers\UMDF\RDPidd.dll when an RDP connection is established. This requires permissions granted to the Users group or the Local Service account. Without these permissions, RDP connections drop immediately after establishment. This issue may also occur when BT-Panel is installed on the system disk.

Relationship between the RDPidd.dll file and the WUDFHost.exe process

RDPidd.dll is part of Windows User-Mode Driver Framework (WUDF) and serves RDP connections. WUDFHost.exe is the main WUDF component that manages user-mode drivers. During RDP connection establishment, WUDFHost.exe calls RDPidd.dll to support RDP operations.

Solution

Restore the Users group permissions on the system disk. The following example uses Windows Server 2019 64-bit. Configurations may vary by operating system version.

  1. Connect to the Windows ECS instance by using VNC.

    See Connect to an instance by using VNC.

  2. Right-click Local Disk (C:) and select Properties. In the Local Disk (C:) Properties dialog box, click Edit... on the Security tab.

  3. In the Permissions for Local Disk (C:) dialog box, click Add...

  4. In the Select Users or Groups dialog box, click Advanced... > Find Now.

  5. In Search results, select Users and click OK.

  6. Verify that the Users group has the following permissions: Read and execute, List folder contents, and Read. Click OK.

  7. Reconnect to the instance with RDP. If the connection persists, the issue is resolved.

<