Gathering RDP event logs from Windows clients and server machines (10, Server 2012, 2016, 2019, etc) (4330122)

1) Download the attached file: enable_debug_log.bat. Make a note of the download location, as this file will be needed in the coming steps.

2) Start the command prompt after looking it up in the Start menu, typing "cmd", or as an alternative:
Use the Windows + R key combination to bring up the Run dialog, then enter cmd and hit ok.

- Please note here that depending on where you will run the enable_debug_log.bat command prompt may need elevated privileges. Example if you will run it in your user folder Documents, Downloads, temp, e.g. you may not need Admin permissions, while for ex. if you run it from C:\ you may need admin privilege.

3) Locate the enable_debug_log.bat file in the command prompt and run it with the on parameter.

enable_debug_log.bat on

If you have any "Access Denied" or similar messages please run the enable_debug_log.bat file elsewhere where you don't need an elevated command prompt or run the command prompt again as an Admin, as per related to the previous step. Proactively you may leave this window open as the last step will be to turn off this running enable_debug_log.bat.

4) After issuing the command in the previous step you may notice a new file has been generated under the same folder as the enable_debug_log.bat

The new file name is events.xml. Please remember this new file as it will be needed.

5) Start the Windows Event Viewer after looking it up in the Start menu, typing 'Event Viewer', or as an alternative:
Use the Windows + R key combination to bring up the Run dialog, then enter eventvwr or eventvwr.msc and hit OK

6) When the Event Viewer is open, select Custom Views, right mouse click on that and select Import Custom View

6) Browse to events.xml which was created by the .bat file earlier and select Open. On the pop-up window named 'Import Custom View File' leave everything on the default settings and select Ok. If you receive any message like "A custom view with the name "Remote Desktop Services" already exist. Do you want to overwrite it?" you can safely choose Yes. You should now have a custom filter named Remote Desktop Services under Custom Views.

As a proactive measure do not close this window as we will be needing it again.

6.5) If you receive any error message window (like the one below) during import of the events.xml please contact support and let them know the contents of the error message, as per there is an issue with the generated xml file.

7) Reproduce the issue with the RDP connection.

8) When you are done with the reproduction go back to Windows Event Viewer, right mouse click on the previously created filter Remote Desktop Services under Custom Views, and Save All Events in Custom View As.

9) For save type select .evtx and type in a friendly name. Please take a note on the save location as this is the file which will be needed to be sent.

10) On the next window select Display Information for these languages and select English. Alternatively you may select No display information if there is an issue with the file or during saving it. Please do note we can only troubleshoot in English, any other language may delay or circumvent our troubleshooting efforts.

11) Send this saved .evtx file to us with attaching to your reply email, or going to your appropriate sr in the support portal.

12) Go back to your command prompt and turn off the running enable_debug_log.bat with the off switch. If you leave this running you can have performance issues as well as a lot of trash log files generating in the background.

enable_debug_log.bat off