Windows 10: MSTSC RDP crashes shortly after launch

Hello,I need your help, My MSTSC Crashes on user session but work on Admin session: Nom de l’application défaillante mstsc.exe, version : 10.0.22621.1778, horodatage : 0xec9868c9Nom du module défaillant : ntdll.dll, version : 10.0.22621.1928, horodatage : 0x7dd9e350Code d’exception : 0xc0000374Décalage d’erreur : 0x000000000010c1f9ID du processus défaillant : 0x0x56A8Heure de début de l’application défaillante&n

:)

 

MSTSC (RDP) crashes shortly after launch

Shortly after launching a remote app on a single computer (other machines work just fine) the program crashes. It shows that it is connected to the server then does not show the app and crashes.

Here is the info from the event viewer:

Faulting application name: mstsc.exe, version: 10.0.18362.752, time stamp: 0x64062c86

Faulting module name: ntdll.dll, version: 10.0.18362.719, time stamp: 0x64d10ee0

Exception code: 0xc0000374

Fault offset: 0x00000000000f92a9

Faulting process id: 0x2fb8

Faulting application start time: 0x01d62d48f044a33e

Faulting application path: C:\Windows\System32\mstsc.exe

Faulting module path: C:\WINDOWS\SYSTEM32\ntdll.dll

Report Id: dee6d851-f8de-421c-a7ec-8d79380c8ac9

Faulting package full name:

Faulting package-relative application ID:

_________________________________________________________________________

And:

Fault bucket 2081841460730338595, type 4

Event Name: APPCRASH

Response: Not available

Cab Id: 0

Problem signature:

P1: mstsc.exe

P2: 10.0.18362.752

P3: 64062c86

P4: StackHash_a93f

P5: 10.0.18362.719

P6: 64d10ee0

P7: c0000374

P8: PCH_3F_FROM_ntdll+0x000000000009CC14

P9:

P10:

Attached files:

\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERF5DA.tmp.mdmp

\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERF752.tmp.WERInternalMetadata.xml

\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERF762.tmp.xml

\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERF772.tmp.csv

\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERF792.tmp.txt

These files may be available here:

\\?\C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_mstsc.exe_372ceec8cb2e794ff4c25976c010cedec6be6_564341b6_28c6c4f9-7099-4eff-a4e8-87ea74a2d1ff

Analysis symbol:

Rechecking for solution: 0

Report Id: 0211195b-a1ef-4f43-a0eb-02eb84c59ba8

Report Status: 268435456

Hashed bucket: 464a66b7afcb329bace42fc749831d23

Cab Guid: 0

_____________________________________________________________________________

Steps I’ve taken:

1. Removed 3 recently installed updates
2. Checked in event viewer for reason codes for the crash
   1. Googled two of them and found one resolution was to:

i.
regsvr32.exe /u ntdll.dll (this will uninstall the file)

ii.
regsvr32.exe ntdll.dll and press (this will reinstall the file).

1. Logged into my own account on computer
   1. Opened remote application
   2. It crashed the first time
   3. It crashed the second time
   4. It worked the third time through the sixth times.
2. Reopened it on the local profile

1. 
   
   1. It crashed and would not successfully open.
2. After recreating the profile, I am briefly able to see the app and type some text to log into it (the actual application), but it crashes again.

 

MSTSC (RDP) crashes shortly after launch

I might suggest to obtain a user mode dump which has the potential to pinpoint the cause and should be similar to the .mdmp .

You can configure Windows to create user-mode dumps. Create a System Restore Point first.

If you copy and paste the following in Notepad and save as a .reg file (save with the .reg extension and give it any name such as dump.reg), then right-click the .reg file and select "Merge" to add to the registry, a .dmp file at the time mstsc.exe crashes
should be created in the C:\CrashDumps folder:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps\mstsc.exe]

"DumpFolder"=hex(2):43,00,3a,00,5c,00,43,00,72,00,61,00,73,00,68,00,44,00,75,\

00,6d,00,70,00,73,00,00,00

After mstsc.exe crashes can you then make the .dmp file available (provide link) via a OneDrive or similar site?

More info on collecting user-mode dumps:

Collecting User-Mode Dumps - Win32 apps(VS.85).aspx

To stop the creation of the user mode dump files run the following registry file:

Windows Registry Editor Version 5.00

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps\mstsc.exe]

You can delete the C:\CrashDumps folder anytime.

 

MSTSC (RDP) crashes shortly after launch

Here is the link to the memory dump:

https://nextcloud..net/index.php/s/Zfwd3jTNgFp6pqz

It looks like there is a "heap corruption", but I don't know what that means.