I have an issue I have been attempting to diagnose for about a week now. I only posted a few times ever and I am not used to requesting assistance so, please if there is anything I should have obviously mentioned just ask and I will fill you in.
Little background. My primary environment is 100% on VMware with 3 hosts using Dell Compellent storage. I have 2 Virtual servers acting as sessions brokers and gateways, one of these servers is a licensing server and I had 12, session hosts. All servers are 2012r2 and were about a month behind on updates when this started around March 6th. I shut down my VMs on the 10th when adding a storage expansion to the environment. After the system came back up this issue hit hard starting right on the 11th.
I am having an issue with the 2012 R2 Session hosts in my environment logging users out and I am not sure why. I have a primary RDS collection and a single server we use for various IT functions acting as its own license server, Session broker and host. Both the primary RDS collection and this IT server both log out users at what appears to be random. When I look in the logs of the Hosts, they show the logoffs as normal events with the reason being 12. I have confirmed the sessions timeouts are set appropriately both in GPO and in the session settings of the collection. These log outs happen if a user connects through the session broker or directly to the server via a console connection as an administrator. I have removed all nonessential GPOs from the servers. The only GPO settings being sent to the servers are a registry key for a database connection, 2 simple scripts to audit and add log on and logoff times to a notepad, loopback set to replace, and a policy adding websites to the trusted sites and allowed pop-ups. I have confirmed these are the only settings for both the user and computer GPO using gpresult.
This log off event happens for users and administrators. while testing I will log my account into each server and monitor so I can view logs when I get the long off the event. The logs as far as I can tell look the same as if I were to hit the log off button in the start menu. Sometimes I will get logged off of just one server, or sometimes 2 or 3 at the same time(confirmed by logs down to the second) which tells me something is causing this event.
Since the issue has started I have removed the expansion cabinet, updated all sessions hosts to current windows updates and added two more hosts for a total of 14. I have removed all nonessential GPOs, double checked and set session timeouts in both the collection session settings and GPO, Attempted to set keep alive in RDS GPO settings to 1. I have around 15-20 users using 1 remote app on these hosts during daytime business hours.
My hope is to get some assistance with diagnosing a possible issue with the server itself, or helping figure out within logs what may be initiating the log of events.
I have not posted any logs because with everything I have looked through this week, I am not sure what is relevant to a trained eye. I can answer any questions and produce logs to anyone who may be able to assist with this issue.