Problem with Remote Desktop Connection Events 7031 and 1000

This error is common after the installation of a new server, especially when we installed Windows 2008 R2 and after SP1 with separate media, usually in this order or similar:

• Installation of Windows 2008 R2 without SP1 (RTM)
• Joins the machine in the field
• Enable Remote Desktop
• Installation of Service Pack 1 of Windows 2008 R2

SYMPTOM

When connecting to the Remote Desktop remote server drops the connection after logon and the RDP service registering falls, 1000, 1001 events 7031 and 7036 (not necessarily all of them).

Event ID: 1000
Faulting application name: svchost. exe_TermService, version: 6.1.7600.16385, time stamp: 0x4a5bc3c1
Faulting module name: rdpcorekmts.dll, version: 6.1.7600.16952, time stamp: 0x4f1f9e66
Exception code: 0xc0000005
Fault offset: 0x000000000000a793
Faulting process id: 0x64c
Faulting application start time: 0x01cd849427006890
Faulting application path: C:\Windows\System32\svchost.exe
Faulting module path: C:\Windows\system32\rdpcorekmts.dll
Report Id: 8edb6c0f-f087-11e1-b956-f04da207fb81

Event ID: 7031
The Remote Desktop Services service terminated unexpectedly. It has done this 1 time (s). The following corrective action will be taken in 60000 milliseconds: Restart the service.

CAUSE

A domain GPO is forcing the secure authentication mode, while the locale setting has been configured to allow unsecured connections. The first image below shows how it was configured locally on the server and the Remote Desktop Protocol (RDP) the second the GPOs that force the secure authentication mode:

RESOLUTION

To resolve this problem, the first step is to log on locally on the server and change the Remote Desktop to allow only secure connections, compatible with the GPO (the third option in the first image above).

If you still have problems, install the Hotfix available in http://support.microsoft.com/kb/2672601