SOLVED SCCM 2111 - some clients black screen when connecting with remote viewer

Pete811

Member
7
0
1
After upgrade on some clients the remote viewer does not work correct. It connects but the remote screen keeps black. This issue is not on every client.
I checked the CmRcService.log but it does not show any error.
Any ideas where can Itake a further look?
 
Solution
Good morning,

@Prajwal Desai
thanks for your effort.
I could figure out the problem. The affected clients use Citrix Remote-PC for Home Office. A "Citrix-DLL" crashed the "SCCMrdpuser.exe". In registry you can exclude the EXE and now the Remote Viewer works as expected.

@Ryan R.
Sorry, here I can't help. We don't have any WIN7 client in our environment
OP
Pete811

Pete811

Member
7
0
1
Thanks.
Yes, the agents are on the latest version (5.00.9068.1008)

CmRcService.log: (looks fine but black screen)
<![LOG[======> A connection has been established. (OnConnectionEstablished)]LOG]!><time="10:10:07.341-60" date="12-16-2021" component="CmRcService" context="" type="1" thread="12128" file="cmrcservice.cpp:716">
<![LOG[Incoming connection IP address: xxx Port: 51585 IsLocationConnection: false]LOG]!><time="10:10:07.341-60" date="12-16-2021" component="CmRcService" context="" type="1" thread="12128" file="cmrcservice.cpp:738">
<![LOG[Ready to start the security handshake.]LOG]!><time="10:10:07.341-60" date="12-16-2021" component="CmRcService" context="" type="1" thread="12128" file="cmrcservice.cpp:1339">
<![LOG[=== Starting security handshake ===]LOG]!><time="10:10:07.341-60" date="12-16-2021" component="CmRcService" context="" type="1" thread="12128" file="cmrcservice.cpp:1353">
<![LOG[=== Security handshake completed [0x10000000] ===]LOG]!><time="10:10:07.341-60" date="12-16-2021" component="CmRcService" context="" type="1" thread="12128" file="cmrcservice.cpp:1358">
<![LOG[The user(xxx) is authorized for Remote Control]LOG]!><time="10:10:07.341-60" date="12-16-2021" component="CmRcService" context="" type="1" thread="12128" file="cmrcservice.cpp:1621">
<![LOG[Session allowed: Full Control]LOG]!><time="10:10:07.341-60" date="12-16-2021" component="CmRcService" context="" type="1" thread="12128" file="cmrcservice.cpp:1414">
<![LOG[=== Session Info ===]LOG]!><time="10:10:07.341-60" date="12-16-2021" component="CmRcService" context="" type="1" thread="12128" file="cmrcservice.cpp:1164">
<![LOG[ Authorized viewer user: xxx]LOG]!><time="10:10:07.341-60" date="12-16-2021" component="CmRcService" context="" type="1" thread="12128" file="cmrcservice.cpp:1176">
<![LOG[ Viewer address: xxx:51585]LOG]!><time="10:10:07.341-60" date="12-16-2021" component="CmRcService" context="" type="1" thread="12128" file="cmrcservice.cpp:1177">
<![LOG[ Host address: xxx:2701]LOG]!><time="10:10:07.341-60" date="12-16-2021" component="CmRcService" context="" type="1" thread="12128" file="cmrcservice.cpp:1189">
<![LOG[Connection completed (ID = 1) (OnConnectionCompleted)]LOG]!><time="10:10:08.636-60" date="12-16-2021" component="CmRcService" context="" type="1" thread="12060" file="cmrcservice.cpp:686">
 

Ryan R.

New Member
1
0
1
Having the same issue here, but only seems to affect Windows 7 systems.

Windows 7 devices that have an older agent on them have no issues with Remote Control Viewer. This certainly seems specific to Windows 7 devices with the latest version (5.00.9068.1008)
 
Last edited:
OP
Pete811

Pete811

Member
7
0
1
Good morning,

@Prajwal Desai
thanks for your effort.
I could figure out the problem. The affected clients use Citrix Remote-PC for Home Office. A "Citrix-DLL" crashed the "SCCMrdpuser.exe". In registry you can exclude the EXE and now the Remote Viewer works as expected.

@Ryan R.
Sorry, here I can't help. We don't have any WIN7 client in our environment
 
Solution

mxcharf

Member
11
3
3
We are having the same issue after updating to 2111, win10 21H2 clients running latest December 2021 CU with client version 5.00.9068.1008. We are not on Citrix environment and SCCMrdpuser.exe already excluded from AV. No errors show on both logs on client and remote control pcs. Any ideas?
 
OP
Pete811

Pete811

Member
7
0
1
We are having the same issue after updating to 2111, win10 21H2 clients running latest December 2021 CU with client version 5.00.9068.1008. We are not on Citrix environment and SCCMrdpuser.exe already excluded from AV. No errors show on both logs on client and remote control pcs. Any ideas?
Do you mean SCCM Logs? I could find the error in the Windows Event Logs
 

marekc

New Member
1
0
1
I confirm problems with remote support after upgrading to version 2111. The target client does not report any errors (log below). Connecting to computers that haven't updated cmsetup yet works fine. Wireshark shows network packet push to port 2701, session start and no response.

======> A connection has been established. (OnConnectionEstablished) CmRcService 28.12.2021 08:40:27 9000 (0x2328)
Incoming connection IP address: 10.0.4.177 Port: 61036 IsLocationConnection: false CmRcService 28.12.2021 08:40:27 9000 (0x2328)
Ready to start the security handshake. CmRcService 28.12.2021 08:40:27 9000 (0x2328)
=== Starting security handshake === CmRcService 28.12.2021 08:40:27 9000 (0x2328)
=== Security handshake completed [0x00000000] === CmRcService 28.12.2021 08:40:27 9000 (0x2328)
The user(==========) is authorized for Remote Control CmRcService 28.12.2021 08:40:27 9000 (0x2328)
Session allowed: Full Control CmRcService 28.12.2021 08:40:27 9000 (0x2328)
=== Session Info === CmRcService 28.12.2021 08:40:27 9000 (0x2328)
Authorized viewer user: ========== CmRcService 28.12.2021 08:40:27 9000 (0x2328)
Viewer address: 10.0.4.177:61036 CmRcService 28.12.2021 08:40:27 9000 (0x2328)
Host address: 10.0.5.73:2701 CmRcService 28.12.2021 08:40:27 9000 (0x2328)
Connection completed (ID = 1) (OnConnectionCompleted) CmRcService 28.12.2021 08:40:31 7656 (0x1DE8)
The connection has been terminated (ID = 1). (OnConnectionTerminated) CmRcService 28.12.2021 08:44:56 7656 (0x1DE8)
 

marksimmer

Member
9
3
3
I'm having the same problem - black screen when trying to remote to client PCs. Not all clients have updated to 5.00.9068.1008, I've found that those clients that remained on 5.00.9058.1047 are still able to "remote" to. Here's my question, if I revert back to a VM Snapshot, done before the 2111 update, will the clients that have been updated to 5.00.9068.1008 (about 90%), still be able to communicate with the Server. I ask, because "technically" this new client version "does not exist" in the 2107 "world"... Thoughts?
 

marksimmer

Member
9
3
3
Here are the Windows Logs in Event Viewer:

Error Level: Event ID 1000

Log Name: Application
Source: Application Error
Date: 12/29/2021 9:42:59 AM
Event ID: 1000
Task Category: (100)
Level: Error
Keywords: Classic
User: N/A
Computer: T6238.xxx.local
Description:
Faulting application name: SCCMrdpuser.exe, version: 5.0.9068.1004, time stamp: 0x6193767f
Faulting module name: SCCMrdpuser.exe, version: 5.0.9068.1004, time stamp: 0x6193767f
Exception code: 0xc0000005
Fault offset: 0x000000000000118f
Faulting process id: 0x3748
Faulting application start time: 0x01d7fcc25ffb39cb
Faulting application path: C:\WINDOWS\CCM\RemCtrl\SCCMrdpuser.exe
Faulting module path: C:\WINDOWS\CCM\RemCtrl\SCCMrdpuser.exe
Report Id: 95945cc0-684d-4395-83b9-573c571ae518
Faulting package full name:
Faulting package-relative application ID:
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Application Error" />
<EventID Qualifiers="0">1000</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>100</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2021-12-29T14:42:59.7742933Z" />
<EventRecordID>7138</EventRecordID>
<Correlation />
<Execution ProcessID="0" ThreadID="0" />
<Channel>Application</Channel>
<Computer>T6238.xxx.local</Computer>
<Security />
</System>
<EventData>
<Data>SCCMrdpuser.exe</Data>
<Data>5.0.9068.1004</Data>
<Data>6193767f</Data>
<Data>SCCMrdpuser.exe</Data>
<Data>5.0.9068.1004</Data>
<Data>6193767f</Data>
<Data>c0000005</Data>
<Data>000000000000118f</Data>
<Data>3748</Data>
<Data>01d7fcc25ffb39cb</Data>
<Data>C:\WINDOWS\CCM\RemCtrl\SCCMrdpuser.exe</Data>
<Data>C:\WINDOWS\CCM\RemCtrl\SCCMrdpuser.exe</Data>
<Data>95945cc0-684d-4395-83b9-573c571ae518</Data>
<Data>
</Data>
<Data>
</Data>
</EventData>
</Event>
 

marksimmer

Member
9
3
3
Information Level: Event ID 1001

Log Name: Application
Source: Windows Error Reporting
Date: 12/29/2021 9:42:59 AM
Event ID: 1001
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: T6238.xxx.local
Description:
Fault bucket 2004822880289772919, type 4
Event Name: APPCRASH
Response: Not available
Cab Id: 0

Problem signature:
P1: SCCMrdpuser.exe
P2: 5.0.9068.1004
P3: 6193767f
P4: SCCMrdpuser.exe
P5: 5.0.9068.1004
P6: 6193767f
P7: c0000005
P8: 000000000000118f
P9:
P10:

Attached files:
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERD918.tmp.mdmp
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERDA13.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERDA43.tmp.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERDA83.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERDAD2.tmp.txt

These files may be available here:
\\?\C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_SCCMrdpuser.exe_fc588315c6bdd80c12ecdfc762ccbbb8f859228_d9f1966f_aeb41be5-13a4-41ae-bb68-bba21711be95

Analysis symbol:
Rechecking for solution: 0
Report Id: 5ce8920f-c3d2-4eab-b617-2b96c295bc36
Report Status: 268435456
Hashed bucket: eb6c2337154b32e8ebd28fc9a13f5577
Cab Guid: 0
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Windows Error Reporting" />
<EventID Qualifiers="0">1001</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2021-12-29T14:42:59.1918113Z" />
<EventRecordID>7137</EventRecordID>
<Correlation />
<Execution ProcessID="0" ThreadID="0" />
<Channel>Application</Channel>
<Computer>T6238.xxx.local</Computer>
<Security />
</System>
<EventData>
<Data>2004822880289772919</Data>
<Data>4</Data>
<Data>APPCRASH</Data>
<Data>Not available</Data>
<Data>0</Data>
<Data>SCCMrdpuser.exe</Data>
<Data>5.0.9068.1004</Data>
<Data>6193767f</Data>
<Data>SCCMrdpuser.exe</Data>
<Data>5.0.9068.1004</Data>
<Data>6193767f</Data>
<Data>c0000005</Data>
<Data>000000000000118f</Data>
<Data>
</Data>
<Data>
</Data>
<Data>
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERD918.tmp.mdmp
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERDA13.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERDA43.tmp.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERDA83.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERDAD2.tmp.txt</Data>
<Data>\\?\C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_SCCMrdpuser.exe_fc588315c6bdd80c12ecdfc762ccbbb8f859228_d9f1966f_aeb41be5-13a4-41ae-bb68-bba21711be95</Data>
<Data>
</Data>
<Data>0</Data>
<Data>5ce8920f-c3d2-4eab-b617-2b96c295bc36</Data>
<Data>268435456</Data>
<Data>eb6c2337154b32e8ebd28fc9a13f5577</Data>
<Data>0</Data>
</EventData>
</Event>
 

mxcharf

Member
11
3
3
I think permissions are broken after the update.
As a test I have physically login to the computer as an account that has MECM RDP access, than I was able to remote in using MECM console to that computer.
 

mxcharf

Member
11
3
3
I'm having the same problem - black screen when trying to remote to client PCs. Not all clients have updated to 5.00.9068.1008, I've found that those clients that remained on 5.00.9058.1047 are still able to "remote" to. Here's my question, if I revert back to a VM Snapshot, done before the 2111 update, will the clients that have been updated to 5.00.9068.1008 (about 90%), still be able to communicate with the Server. I ask, because "technically" this new client version "does not exist" in the 2107 "world"... Thoughts?
Reverting snapshot is not supported by MS and will lead to problems, particularly with end clients.
 

Forum statistics

Threads
4,616
Messages
18,062
Members
9,327
Latest member
Oscar_Mancera