Windows 10: Hacked? RDP logs on Windows 11 Home edition

A few days ago, I decided to check Event Viewer Logs after noticing a few oddities with my PC. I have Windows 11 Home Edition installed, so RDP should be disabled by default. Yet I found hundreds of events logged in the Terminal Service Local Session Manager Operational Logs. The events had the EventIDs 21, 22, 23, 24, 34, 39, 40, 41, 42, 54 and probably some more. There were multiple Events logged each day, yet I never used RDP once, and as I've previously mentioned, I have Windows 11 Home Edition installed. I did a clean reset not that long ago, so now I'm suspecting that I was hacked, the

:)

 

Weird RDP behavior in Windows 11

Hi,

what's wrong with RDP in Windows 11? I've never had so many problems with RDP in all computers together, than now with one single Windows 11 PC. I have service PC, which is always on for RDP purposes, so I can login remotely from field. Upgraded it to Windows 11 and I regret decision.

What's happening?

Well, as I am always logged-in and have really gozillion of apps opened, I only lock computer, so I can work on those apps via RDP all the time. But now with Windows 11 it is not possible anymore:

• SOMETIMES I land in new profile, empty login, while my active login I can see under logged-in users and I CAN switch to this login.
  
• OTHER TIMES I land in new profile, empty login, and there's no sign of my business login, all apps are closed and it goes up to 100 f-words per minute, as I need to reopen all tasks again.
  
• But when I come back from field to this PC, I cannot login back to any session I opened via RDP, but can only login to empty login, and here goes opening all apps again and neighbors can hear my yelling
  

How can I switch back this stupid RDP behavior back to how it worked in Windows 10?

 

weird problem with RDP to Windows 10 - blank screen after minimizing

Should not be as you can only legitimately log on one user at a time to consumer editions. There are hacks to enable multiple log-in but that is outside scope of the question really.

Unless MS broke something by fixing something else of course.

Everything else I tried (WebEx, TeamViewer et al) is much worse than RDP. If you are connecting from Linux to Windows Remmina is best of the bunch but it uses RDP anyway.

 

Unable to RDP to Windows 11 Machine

I hope someone can help as I have been pulling my hair out for a few weeks over this issue.

I have a Windows 11 Virtual Machine in Azure which I have been able to connect to until recently. When connecting it gets to Securing connection and it then fails. I have tried a local user account and it connects fine with no issues. As soon as I use my AAD user it has this issue my account is AD Synced from local AD. I have tried to login to the VM using a cloud only account as this also works.

I have also setup a Windows 365 Cloud PC and this is also doing the same thing and not letting me connect with my AAD account.

• Virtual PC is Windows 11 22H2.
  
• Joined to Azure AD with Intune
  
• I can login if I am using a 3rd party tool such as Teamviewer or Connectwise Control.
  
• I can login to the VM using local credentials via RDP.
  
• I can login to the VM using another AAD account (Non AD Synced) via RDP.
  
• I have made my AAD account Cloud only and I am still experiencing the same thing.
  
• I have tried the Registry UDP fix for Windows 11.
  
• I have tried a fresh install of Windows 11 22H2 on my laptop in case this was causing some issues.
  
• I have tried to re join the VM to AAD.
  

When connecting to the Azure VM using my login details that fail, I get these 2 errors in the event log. (RemoteDesktopServices-RdpCoreTS/Operational)

• RDP_TCP: An error was encountered when transitioning from StateUnknown in response to Event_Disconnect (error code 0x80070040).
  
• TCP socket READ operation failed, error 64
  

Really hopeful someone has come across this before and can help.