Jump to content
Welcome to our new Citrix community!
  • 0

Windows Server 2012 R2 Remote Desktop Services - RDP client gets black screen, System Event ID 4005, TerminalServices Event ID 36


RDP users (Citrix XenApp) are getting connections refused/dropped and a black screen. This is Citrix MCS spawned terminal services on Windows Server 2012 R2.


After extensive Internet search with these symptoms I am coming up empty. I reviewed EventTracker and related MicrosoftHelp but these recommendations do not seem to apply in this case or are too vague to be useful. Those articles suggest a server resource constraint (we do not see this, unless it was temporary and is no longer present when the system event occurs), registry corruption (this seems very unlikely, but even if true, how do we determine which registry hive or key is corrupt?) or a service that needs restarting (which service? we do not see any errors showing failed or stopped services).


On the server seeing these messages:

Log Name:      Microsoft-Windows-TerminalServices-LocalSessionManager/Operational
Source:        Microsoft-Windows-TerminalServices-LocalSessionManager
Date:          5/7/2019 12:08:15 PM
Event ID:      36
Task Category: None
Level:         Error
User:          SYSTEM
Computer:      CTXIAHYP004.mydomain.com
An error occurred when transitioning from CsrConnected in response to EvCsrInitialized. (ErrorCode 0x80004005)

Log Name:      Application
Source:        Microsoft-Windows-Winlogon
Date:          5/7/2019 12:08:15 PM
Event ID:      4005
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      CTXIAHYP004.mydomain.com
The Windows logon process has unexpectedly terminated.


Link to comment

2 answers to this question

Recommended Posts

  • 0

This was our solution.


Epic Systems recommends the HungAppTimeout registry hack. His link on the Userweb site is https://userweb.epic.com/Thread/61367 



Key Path: Control Panel\Desktop

Value Name: HungAppTimeout

Value Type: REG_SZ

Value data: 30000


The black screen is an emergent behavior from the combination of Citrix 7.15 and Windows Server 2012 R2 +. What happens is that if an application window becomes unresponsive (due to long load times or otherwise) Windows will wait a certain amount of time for that application to become responsive again before it “ghosts” the window. This is what Microsoft’s documentation is referring to when they say “a forced process end is attempted”. The default time interval that Windows will wait for is 5 seconds (5000 milliseconds) before ghosting the window, this is controlled by the HungAppTimeout registry value.


Due to the layers of windows within Epic Hyperspace, a ghosted session over Citrix will appear as a black screen. This is what we see happening right now when Hyperspace takes more than 5 seconds to load (whether it is a large report or otherwise).  Changing the HungAppTimeout value to 30 seconds will allow Hyperspace to load for at least 30 seconds before ghosting, which should be less disruptive to users who are not expecting a black screen.


Link to comment

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Create New...