Problem : The terminal server received large number of incomplete connections. The system may be under attack
I have a WIndows XP workstation that is fully patched and is set up for remote access. We haven’t been able to log into it remotely and when I check the log files, I see the following messages;
The terminal server received large number of incomplete connections. The system may be under attack
Event ID 1006
and the other message that I occationally get is as follows;
The RDP protocol component X.224 detected an error in the protocol stream and has disconnected the client.
Event ID: 50
Any ideas? Is the Windows OS shutting down the remote access? For how long?
Solution : The terminal server received large number of incomplete connections. The system may be under attack
Have you checked these articles?
Event ID: 1006
http://eventid.net/display.asp?eventid=1006&eventno=2187&source=Userenv&phase=1
Event ID: 50
http://eventid.net/display.asp?eventid=50&source=
