What's new
Forums on Intune, SCCM, and Windows 11

Welcome to the forums. Register a free account today to become a member! Once signed in, you'll be able to participate on this site by adding your topics and posts, as well as connect with other members through your own private inbox!

SOLVED SCCM 2111 - some clients black screen when connecting with remote viewer

  • Thread starter Thread starter Pete811
  • Start date Start date
  • Replies Replies 43
  • Views Views 20K
Pete811

Pete811

Member
Messages
7
Solutions
1
Reaction score
0
Points
1
After upgrade on some clients the remote viewer does not work correct. It connects but the remote screen keeps black. This issue is not on every client.
I checked the CmRcService.log but it does not show any error.
Any ideas where can Itake a further look?
 
Solution
Pete811
Good morning,

@Prajwal Desai
thanks for your effort.
I could figure out the problem. The affected clients use Citrix Remote-PC for Home Office. A "Citrix-DLL" crashed the "SCCMrdpuser.exe". In registry you can exclude the EXE and now the Remote Viewer works as expected.

@Ryan R.
Sorry, here I can't help. We don't have any WIN7 client in our environment
Sort by date Sort by votes
I am working on this. Checking if I see the same behavior in my lab. Can you confirm the ConfigMgr agents are on latest version?
 
Upvote 0 Downvote
Thanks.
Yes, the agents are on the latest version (5.00.9068.1008)

CmRcService.log: (looks fine but black screen)
<![LOG[======> A connection has been established. (OnConnectionEstablished)]LOG]!><time="10:10:07.341-60" date="12-16-2021" component="CmRcService" context="" type="1" thread="12128" file="cmrcservice.cpp:716">
<![LOG[Incoming connection IP address: xxx Port: 51585 IsLocationConnection: false]LOG]!><time="10:10:07.341-60" date="12-16-2021" component="CmRcService" context="" type="1" thread="12128" file="cmrcservice.cpp:738">
<![LOG[Ready to start the security handshake.]LOG]!><time="10:10:07.341-60" date="12-16-2021" component="CmRcService" context="" type="1" thread="12128" file="cmrcservice.cpp:1339">
<![LOG[=== Starting security handshake ===]LOG]!><time="10:10:07.341-60" date="12-16-2021" component="CmRcService" context="" type="1" thread="12128" file="cmrcservice.cpp:1353">
<![LOG[=== Security handshake completed [0x10000000] ===]LOG]!><time="10:10:07.341-60" date="12-16-2021" component="CmRcService" context="" type="1" thread="12128" file="cmrcservice.cpp:1358">
<![LOG[The user(xxx) is authorized for Remote Control]LOG]!><time="10:10:07.341-60" date="12-16-2021" component="CmRcService" context="" type="1" thread="12128" file="cmrcservice.cpp:1621">
<![LOG[Session allowed: Full Control]LOG]!><time="10:10:07.341-60" date="12-16-2021" component="CmRcService" context="" type="1" thread="12128" file="cmrcservice.cpp:1414">
<![LOG[=== Session Info ===]LOG]!><time="10:10:07.341-60" date="12-16-2021" component="CmRcService" context="" type="1" thread="12128" file="cmrcservice.cpp:1164">
<![LOG[ Authorized viewer user: xxx]LOG]!><time="10:10:07.341-60" date="12-16-2021" component="CmRcService" context="" type="1" thread="12128" file="cmrcservice.cpp:1176">
<![LOG[ Viewer address: xxx:51585]LOG]!><time="10:10:07.341-60" date="12-16-2021" component="CmRcService" context="" type="1" thread="12128" file="cmrcservice.cpp:1177">
<![LOG[ Host address: xxx:2701]LOG]!><time="10:10:07.341-60" date="12-16-2021" component="CmRcService" context="" type="1" thread="12128" file="cmrcservice.cpp:1189">
<![LOG[Connection completed (ID = 1) (OnConnectionCompleted)]LOG]!><time="10:10:08.636-60" date="12-16-2021" component="CmRcService" context="" type="1" thread="12060" file="cmrcservice.cpp:686">
 
Upvote 0 Downvote
Having the same issue here, but only seems to affect Windows 7 systems.

Windows 7 devices that have an older agent on them have no issues with Remote Control Viewer. This certainly seems specific to Windows 7 devices with the latest version (5.00.9068.1008)
 
Last edited:
Upvote 0 Downvote
Good morning,

@Prajwal Desai
thanks for your effort.
I could figure out the problem. The affected clients use Citrix Remote-PC for Home Office. A "Citrix-DLL" crashed the "SCCMrdpuser.exe". In registry you can exclude the EXE and now the Remote Viewer works as expected.

@Ryan R.
Sorry, here I can't help. We don't have any WIN7 client in our environment
 
Upvote 1 Downvote
Solution
We are having the same issue after updating to 2111, win10 21H2 clients running latest December 2021 CU with client version 5.00.9068.1008. We are not on Citrix environment and SCCMrdpuser.exe already excluded from AV. No errors show on both logs on client and remote control pcs. Any ideas?
 
Upvote 0 Downvote
mxcharf said:
We are having the same issue after updating to 2111, win10 21H2 clients running latest December 2021 CU with client version 5.00.9068.1008. We are not on Citrix environment and SCCMrdpuser.exe already excluded from AV. No errors show on both logs on client and remote control pcs. Any ideas?
Click to expand...
Do you mean SCCM Logs? I could find the error in the Windows Event Logs
 
Upvote 0 Downvote
Hello, we have the same issue with win10 and latest client. If workstation is locked remote connect working.
 
Last edited:
Upvote 0 Downvote
I confirm problems with remote support after upgrading to version 2111. The target client does not report any errors (log below). Connecting to computers that haven't updated cmsetup yet works fine. Wireshark shows network packet push to port 2701, session start and no response.

======> A connection has been established. (OnConnectionEstablished) CmRcService 28.12.2021 08:40:27 9000 (0x2328)
Incoming connection IP address: 10.0.4.177 Port: 61036 IsLocationConnection: false CmRcService 28.12.2021 08:40:27 9000 (0x2328)
Ready to start the security handshake. CmRcService 28.12.2021 08:40:27 9000 (0x2328)
=== Starting security handshake === CmRcService 28.12.2021 08:40:27 9000 (0x2328)
=== Security handshake completed [0x00000000] === CmRcService 28.12.2021 08:40:27 9000 (0x2328)
The user(==========) is authorized for Remote Control CmRcService 28.12.2021 08:40:27 9000 (0x2328)
Session allowed: Full Control CmRcService 28.12.2021 08:40:27 9000 (0x2328)
=== Session Info === CmRcService 28.12.2021 08:40:27 9000 (0x2328)
Authorized viewer user: ========== CmRcService 28.12.2021 08:40:27 9000 (0x2328)
Viewer address: 10.0.4.177:61036 CmRcService 28.12.2021 08:40:27 9000 (0x2328)
Host address: 10.0.5.73:2701 CmRcService 28.12.2021 08:40:27 9000 (0x2328)
Connection completed (ID = 1) (OnConnectionCompleted) CmRcService 28.12.2021 08:40:31 7656 (0x1DE8)
The connection has been terminated (ID = 1). (OnConnectionTerminated) CmRcService 28.12.2021 08:44:56 7656 (0x1DE8)
 
Upvote 1 Downvote
I'm having the same problem - black screen when trying to remote to client PCs. Not all clients have updated to 5.00.9068.1008, I've found that those clients that remained on 5.00.9058.1047 are still able to "remote" to. Here's my question, if I revert back to a VM Snapshot, done before the 2111 update, will the clients that have been updated to 5.00.9068.1008 (about 90%), still be able to communicate with the Server. I ask, because "technically" this new client version "does not exist" in the 2107 "world"... Thoughts?
 
Upvote 1 Downvote
Here are the Windows Logs in Event Viewer:

Error Level: Event ID 1000

Log Name: Application
Source: Application Error
Date: 12/29/2021 9:42:59 AM
Event ID: 1000
Task Category: (100)
Level: Error
Keywords: Classic
User: N/A
Computer: T6238.xxx.local
Description:
Faulting application name: SCCMrdpuser.exe, version: 5.0.9068.1004, time stamp: 0x6193767f
Faulting module name: SCCMrdpuser.exe, version: 5.0.9068.1004, time stamp: 0x6193767f
Exception code: 0xc0000005
Fault offset: 0x000000000000118f
Faulting process id: 0x3748
Faulting application start time: 0x01d7fcc25ffb39cb
Faulting application path: C:\WINDOWS\CCM\RemCtrl\SCCMrdpuser.exe
Faulting module path: C:\WINDOWS\CCM\RemCtrl\SCCMrdpuser.exe
Report Id: 95945cc0-684d-4395-83b9-573c571ae518
Faulting package full name:
Faulting package-relative application ID:
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Application Error" />
<EventID Qualifiers="0">1000</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>100</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2021-12-29T14:42:59.7742933Z" />
<EventRecordID>7138</EventRecordID>
<Correlation />
<Execution ProcessID="0" ThreadID="0" />
<Channel>Application</Channel>
<Computer>T6238.xxx.local</Computer>
<Security />
</System>
<EventData>
<Data>SCCMrdpuser.exe</Data>
<Data>5.0.9068.1004</Data>
<Data>6193767f</Data>
<Data>SCCMrdpuser.exe</Data>
<Data>5.0.9068.1004</Data>
<Data>6193767f</Data>
<Data>c0000005</Data>
<Data>000000000000118f</Data>
<Data>3748</Data>
<Data>01d7fcc25ffb39cb</Data>
<Data>C:\WINDOWS\CCM\RemCtrl\SCCMrdpuser.exe</Data>
<Data>C:\WINDOWS\CCM\RemCtrl\SCCMrdpuser.exe</Data>
<Data>95945cc0-684d-4395-83b9-573c571ae518</Data>
<Data>
</Data>
<Data>
</Data>
</EventData>
</Event>
 
Upvote 0 Downvote
Information Level: Event ID 1001

Log Name: Application
Source: Windows Error Reporting
Date: 12/29/2021 9:42:59 AM
Event ID: 1001
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: T6238.xxx.local
Description:
Fault bucket 2004822880289772919, type 4
Event Name: APPCRASH
Response: Not available
Cab Id: 0

Problem signature:
P1: SCCMrdpuser.exe
P2: 5.0.9068.1004
P3: 6193767f
P4: SCCMrdpuser.exe
P5: 5.0.9068.1004
P6: 6193767f
P7: c0000005
P8: 000000000000118f
P9:
P10:

Attached files:
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERD918.tmp.mdmp
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERDA13.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERDA43.tmp.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERDA83.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERDAD2.tmp.txt

These files may be available here:
\\?\C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_SCCMrdpuser.exe_fc588315c6bdd80c12ecdfc762ccbbb8f859228_d9f1966f_aeb41be5-13a4-41ae-bb68-bba21711be95

Analysis symbol:
Rechecking for solution: 0
Report Id: 5ce8920f-c3d2-4eab-b617-2b96c295bc36
Report Status: 268435456
Hashed bucket: eb6c2337154b32e8ebd28fc9a13f5577
Cab Guid: 0
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Windows Error Reporting" />
<EventID Qualifiers="0">1001</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2021-12-29T14:42:59.1918113Z" />
<EventRecordID>7137</EventRecordID>
<Correlation />
<Execution ProcessID="0" ThreadID="0" />
<Channel>Application</Channel>
<Computer>T6238.xxx.local</Computer>
<Security />
</System>
<EventData>
<Data>2004822880289772919</Data>
<Data>4</Data>
<Data>APPCRASH</Data>
<Data>Not available</Data>
<Data>0</Data>
<Data>SCCMrdpuser.exe</Data>
<Data>5.0.9068.1004</Data>
<Data>6193767f</Data>
<Data>SCCMrdpuser.exe</Data>
<Data>5.0.9068.1004</Data>
<Data>6193767f</Data>
<Data>c0000005</Data>
<Data>000000000000118f</Data>
<Data>
</Data>
<Data>
</Data>
<Data>
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERD918.tmp.mdmp
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERDA13.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERDA43.tmp.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERDA83.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERDAD2.tmp.txt</Data>
<Data>\\?\C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_SCCMrdpuser.exe_fc588315c6bdd80c12ecdfc762ccbbb8f859228_d9f1966f_aeb41be5-13a4-41ae-bb68-bba21711be95</Data>
<Data>
</Data>
<Data>0</Data>
<Data>5ce8920f-c3d2-4eab-b617-2b96c295bc36</Data>
<Data>268435456</Data>
<Data>eb6c2337154b32e8ebd28fc9a13f5577</Data>
<Data>0</Data>
</EventData>
</Event>
 
Upvote 0 Downvote
I think permissions are broken after the update.
As a test I have physically login to the computer as an account that has MECM RDP access, than I was able to remote in using MECM console to that computer.
 
Upvote 0 Downvote
marksimmer said:
I'm having the same problem - black screen when trying to remote to client PCs. Not all clients have updated to 5.00.9068.1008, I've found that those clients that remained on 5.00.9058.1047 are still able to "remote" to. Here's my question, if I revert back to a VM Snapshot, done before the 2111 update, will the clients that have been updated to 5.00.9068.1008 (about 90%), still be able to communicate with the Server. I ask, because "technically" this new client version "does not exist" in the 2107 "world"... Thoughts?
Click to expand...
Reverting snapshot is not supported by MS and will lead to problems, particularly with end clients.
 
Upvote 0 Downvote
You must log in or register to reply here.

Similar threads

  • PENDING Entra Joined Clients Are Not Updating
  • PENDING Connection Point Server Disconnected
  • Microsoft Intune August 2025 Update (Service Release 2508)
  • SOLVED Updates showing up as not required.
  • PENDING Minimal install guide for SCCM OSD for MDT users?

    • Forum statistics

    Threads
    7,053
    Messages
    27,549
    Members
    17,769
    Latest member
    Fmiscioterf

    Latest posts

    Trending content
    Back
    Top