July 07-2024 Updates Break Remote Desktop Gateway Servers

Martin 65

We are seeing the issue on 2 of our four RDS Gateways (running 2022 STD).

Faulting application name: svchost.exe_TSGateway,
version: 10.0.20348.2520,
time stamp: 0xf862c7cb
Faulting module name: aaedge.dll,
version: 10.0.20348.2582,
time stamp: 0x78ded40f
Exception code: 0xc0000005
Fault offset: 0x000000000006613c
Faulting process id: 0x273c
Faulting application start time: 0x01dad77010a2bee1
Faulting application path: C:WINDOWS\system32\svchost.exe
Faulting module path: c:windows\system32\aaedge.dll
Report Id: d4502b05-b974-4660-bc13-5f2da108f403
Faulting package full name:
Faulting package-relative application ID:

and in TerminalServices-Gateway log:
The following exception code "3221225477" occured in the RD Gateway server. The RD Gateway will be restarted. No user action is required.

The results of these crashes are that all users connected via the affected gateway are immediately disconnected and must reconnect. Obviously very disruptive when its happening every 30 or so minutes!

Remove of the CU immediately "cures" the issue.

Anyone else seeing issues? Anyone managed to raise a case with PSS / get any feedback from Microsoft? Multiple reports of this starting to come out the woodwork on various forums.

Oh whilst I remember, why on earth did Microsoft kill off old technet forums, they were brilliant, compared to this garbage (progress right?)

Magzz 0 Reputation points

2024-07-16T11:58:22.08+00:00

We are having the same problem on 6 out of 7 2019 RDS-gateways

Have you found a solution yet?

Regards

Magzz
Martin 65 Reputation points

2024-07-16T12:38:35.97+00:00

Nothing yet other than rolling back the update :-( As you can imagine our security team aren't particularly happy with that "solution"
Mario M 5 Reputation points

2024-07-16T15:22:23.75+00:00

same problem on Windows Server 2016... rollback of KB5040434 fixed the problem....
Trey Contello 15 Reputation points

2024-07-16T20:22:47.6066667+00:00

I experienced the same issue on our Windows 2019 RDS Gateways. The problem started right after July patches were installed. I uninstalled the July update (KB5040430) and haven't seen the trouble since.
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Pokey_80 0 Reputation points

2024-07-17T13:23:45.37+00:00

I experienced the same issue on our Windows 2019 RDS Gateways. The problem started right after July patches were installed. I uninstalled the July update (KB5040430) and am waiting to see the outcome. Have also temporarily blocked the update on our update server as KB5040430 will re-install itself (or did on ours)
Pokey_80 0 Reputation points

2024-07-17T13:25:57.0066667+00:00
how practical is this for a large setup? it seems like far too much hassle certainly where BYOD devices play a part.

From all Windows client machines, delete the registry entry associated with RDGClientTransport. The specific path to this entry is: HKCU\SOFTWARE\Microsoft\Terminal Service Client\RDGClientTransport.
Trey Contello 15 Reputation points

2024-07-17T13:41:54.1466667+00:00

Karlie, what RDP clients would typically use this transport? And once disabled, what alternate transport would be used?
Martin 65 Reputation points

2024-07-22T11:04:59.2066667+00:00

Karlie's "Answer" is incorrect.
Not sure where "port 3388" can from? TCP? UDP? what's the source?

Also not feasible / factually correct to delete the registry key from remote systems using an RDS Gateway, by definition these are likely to be BYOD endpoints, how does this fix a MAC or Linux client :-D

But thanks for trying to help.
TK 300 Reputation points

2024-07-22T18:54:37.5666667+00:00

When is Microsoft planning to acknowledge the issue?
Karlie Weng 18,521 Reputation points Microsoft Vendor

2024-07-23T00:09:08.07+00:00

Hello all,

I apologize for any misinformation that was provided. It appears there were some inaccuracies in the workaround I previously shared, so I've removed them to avoid any confusion for other users. I've noticed that quite a few people have already reported such issues to Microsoft. I understand the frustration that comes with waiting for the next updates. But rest assured, as soon as there's an update or a better solution, I'll make sure to share it right away.

Thanks for your patience.
Antonio Urban - Systech 5 Reputation points

2024-07-24T08:57:05.6966667+00:00

Same problem here, with server 2016 RDGs. I have two. In one I removed the patch, and no issues. The other one failed just now
John Randall 0 Reputation points

2024-08-09T08:52:53.2+00:00

We experienced same problem on Windows Server 2012 R2... Rollback of KB5040456 fixed the problem.
Malcolm 10 Reputation points

2024-09-04T04:11:43.7266667+00:00

After resolving the issue by removing July patch KB5040437 on Windows Server 2022, the August patching has re-created the issue, but this time the crash occurs when a user disconnects or logs off from the remote machine. After 5 minutes or so the service recovers and accepts connections again.
Ferry Knol 10 Reputation points

2024-09-06T00:45:08.72+00:00

For those who like to know.
I got the exact same issue as Malcom described.
Today (05-09-2024) i discovered that KB5041160 (august 2024 update) for Windows server 2022 is causing the issue.
After an uninstall of KB5041160 i was able to resolve it.
Bernhard Weitlaner 20 Reputation points

2024-09-12T05:53:44.4133333+00:00

Hello,

has somebody tried to install the september cumulative update? Are the issues resolved?
Thanks.
Bernhard Weitlaner 20 Reputation points

2024-09-13T06:18:33.9533333+00:00

I tried it, it is not solved in september cumulative update. :-(
Humpix 31 Reputation points

2024-09-13T09:05:21.2233333+00:00

Error is still there with September patches, Server 2019 - any news on this?
TK 300 Reputation points

2024-09-13T14:33:55.27+00:00

Microsoft has now updated the September OS KB links in the last 24 hours to acknowledge that the issue is still there. At least they didn't dilly-dally to acknowledge the issue, unlike previous months. See for example: https://support.microsoft.com/en-us/topic/september-10-2024-kb5043051-os-build-14393-7336-03d6cb4e-2d98-4048-a5fe-91ad913e34b5
Evgeny Akhtimirov 5 Reputation points

2024-09-22T10:54:52.98+00:00

https://support.microsoft.com/en-us/topic/september-10-2024-kb5043051-os-build-14393-7336-03d6cb4e-2d98-4048-a5fe-91ad913e34b5
Now Microsoft says that there are no known issues.

But there IS the issue!
Hakikat Singh 15 Reputation points

2024-10-09T07:47:27.0633333+00:00

Finally this issue has been resolved in October 2024 patch
TK 300 Reputation points

2024-10-09T14:11:27.8033333+00:00

@Hakitkat Singh I hope you are correct but It remains to be seen. Last month, the release notes said they had fixed the issue and then within 48 hours, they updated the KB article to essentially say, "No, we still haven't fixed it."
Alan O'Riordan 16 Reputation points

2024-10-09T14:17:16.92+00:00

Everyone seems to be waiting to see who's brave enough to take one for the team and try it. The rest of us are too tramatised and don't want to annoy their customers even further. A couple of sayings spring to mind:

Once bitten, twice shy.
Fool me once, shame on you; fool me twice, shame on me (Shame on Microsoft)... I added that last bit....
Hakikat Singh 15 Reputation points

2024-10-10T07:30:19.7966667+00:00

Yes, after installing latest update on Windows 2016 RD gateway servers, Issue has been resolved and now no termination of remote sessions and no error/warning in event logs too...
John Randall 0 Reputation points

2024-10-14T20:31:38.2333333+00:00

@Hakitkat Singh - Thank you for your reassuring good news update.
The following Microsoft links for the October updates (e.g. KB5044293 & KB5044277) claims that the RD Gateway issue has been resolved.
Can anyone provide good (or bad) feedback after installed the October update?

https://support.microsoft.com/en-us/topic/october-8-2024-kb5044293-os-build-14393-7428-3f172048-e2d1-4eb2-b6b9-41abd891e52f

https://support.microsoft.com/en-us/topic/october-8-2024-kb5044277-os-build-17763-6414-edccc872-2f4e-4ac6-b224-50ca8f1acd4f
Malcolm 10 Reputation points

2024-10-16T22:07:38.9566667+00:00

KB5044281 (October cumulative Server 2022) has resolved the issue for my WS2022 Gateway issue. I did not uninstall any previous updates prior to patching.
John Randall 0 Reputation points

2024-10-29T07:57:01.8433333+00:00

Just to confirm that after a week of testing, the October Cumulative Windows Server update has solved the Gateway issue for us too.

7 answers

Karlie Weng 18,521 Reputation points Microsoft Vendor

2024-07-31T02:23:27.55+00:00

Hello,

This is now a known issue in these updates:
Windows Server 2022:

July 9, 2024—KB5040437 (OS Build 20348.2582) - Microsoft Support

Windows Server 2012:

July 9, 2024—KB5040485 (Monthly Rollup) - Microsoft Support

July 9, 2024—KB5040456 (Monthly Rollup) - Microsoft Support

Windows 10:

July 9, 2024—KB5040434 (OS Build 14393.7159) - Microsoft Support

July 9, 2024—KB5040430 (OS Build 17763.6054) - Microsoft Support

Engineers are working on a resolution and will provide an update in an upcoming release.

If the Answer is helpful, please click Accept Answer and upvote it.
Please sign in to rate this answer.

4 people found this answer helpful.
ASHB 0 Reputation points

2024-07-31T13:59:47.83+00:00

Hi, update in an upcoming release. Can we have some sort of indication if this is days or weeks please..

Karlie Weng 18,521 Reputation points Microsoft Vendor

2024-08-06T05:49:16.8766667+00:00

The timing of the new update will be specified in the release notes, so we need to keep an eye on them. As soon as there is an update, I will share it immediately.

Leonardo Almeida 0 Reputation points

2024-08-07T01:49:22.3766667+00:00

This response from Microsoft was very superficial and didn't provide any guidance!

I uninstalled the update and everything started working again, but then the update started and everything stopped again!

I found a link to an application provided by Microsoft that hides the update selected by the user.

The best solution I've found so far!

Here's the link, it's really easy!

https://answers.microsoft.com/pt-br/windows/forum/all/bloquear-definitivamente-uma-atualiza%c3%a7%c3%a3o/6393dc2a-f675-4cee-9e98-a73633cf100c

Viktor Hedberg 15 Reputation points MVP

2024-09-06T13:50:19.13+00:00

These workarounds suggested do not work for my customers. Multiple environments affected by this. Any ETA on an update to fix this?
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Peter-Frank Lemmens 5 Reputation points

2024-07-23T14:06:58.5166667+00:00

We installed the July patch to solved the (CVE-2024-38074, CVE-2024-38076 en CVE-2024-38077 E issue on the remote desktop Licensing (Which is also on our gateway. (Remote code execution) so it's not as easy as uninstall july cummulative update. Hopefully they bring out a patch or an out-of-band patch.
Please sign in to rate this answer.

1 person found this answer helpful.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Joost Martijn van Engelen 5 Reputation points

2024-08-15T07:27:23.02+00:00

Even after the monthly patches of August I still see this error in the Eventlogs...
But now Im not be able to remove the causing update anymore..
Please sign in to rate this answer.

1 person found this answer helpful.
Oscar Moyano 66 Reputation points

2024-08-15T15:57:00.1633333+00:00

same issue can't uninstall the KB and have gateway down every 40-50m

Coffee 15 Reputation points

2024-08-24T11:33:06.1566667+00:00

I still have the same problem. Uninstalled in July and it worked fine, then in August the problem recurred.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Coffee 15 Reputation points

2024-07-31T10:11:10.0533333+00:00

I also encountered the same case with Server 2019 Datacenter. The problem repeated many times, it stopped the service by itself and after a period of time it started the service again.
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Antonio Urban - Systech 5 Reputation points

2024-08-16T08:17:59.3533333+00:00

I have tried a few things from different forums. This suggestion has worked for me. Basically, disable RPC protocol on the RDG server.

Set-ItemProperty Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RPC\RpcProxy Enabled 0

So now my RDG servers have latest patch applied, and users connections are stable. Only caveat is that you have to use only HTTP connections
Please sign in to rate this answer.
Antonio Urban - Systech 5 Reputation points

2024-08-16T08:20:04.1566667+00:00

Of course, still HTTPS connections...in case of confusion

Oscar Moyano 66 Reputation points

2024-08-16T08:27:37.49+00:00

I'm going to try this

Leonardo Almeida 0 Reputation points

2024-08-17T15:36:53.6666667+00:00

I solved the error by uninstalling the KB and hiding it of reinstallation

Magzz 0 Reputation points

2024-08-20T10:32:40.8366667+00:00

@Oscar Moyano I'm considering the same solution. Did it work for you?

Oscar Moyano 66 Reputation points

2024-08-20T13:12:30.9866667+00:00

Yes It works

Alan O'Riordan 16 Reputation points

2024-08-20T15:22:47.37+00:00

Do any of you use App Proxy for RDWeb access. Curious to know what effect changing this RPCProxy registry change has with this method?

Jorge Hernandez 21 Reputation points

2024-08-20T15:27:10.6633333+00:00

Antonio, did you do this registry change while users were logged in? or while the users are off?

Antonio Urban - Systech 5 Reputation points

2024-08-21T07:09:52.64+00:00

I told users that I needed to make a change and they might lose connection. They did lose the connection, but they managed to reconnect quickly, after I restarted the Gateway server. You do need to restart it ...I believe.

Antonio Urban - Systech 5 Reputation points

2024-08-21T07:14:23.1633333+00:00

In response to Alan, my users don't use app proxy, so don't know the consequences.

Alan O'Riordan 16 Reputation points

2024-08-22T09:21:24.1+00:00

Doing this on App Proxy configured RD Gateway's broke all connectivity with this message even when Gateway service was stable and Event logs clear of the message. I had to uninstall the August patch, not great.

Evgeny Akhtimirov 5 Reputation points

2024-09-22T10:50:50.07+00:00

I did the same and now a small number of users cannot connect.

I checked old events and found that they were using RPC-HTTP transport.

For new attempt I don't see any events (
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

July 07-2024 Updates Break Remote Desktop Gateway Servers

7 answers

Your answer