When attempting to shadow (Remote Control) a session on Windows Server 2008 R2 that has Aero enabled, you may receive the following error:
The Terminal Server security layer detected an error in the protocol stream and has disconnected the client.
When this occurs, the shadowing client disconnects. In addition, you may see both of the following events listed in the System event log:
Log Name: System Source: TermDD Date: 4/5/2011 1:14:24 PM Event ID: 50 Task Category: None Level: Error Keywords: Classic User: N/A Computer: computername.domain.com Description: The RDP protocol component WD detected an error in the protocol stream and has disconnected the client.
Log Name: System Source: TermDD Date: 4/5/2011 1:14:24 PM Event ID: 56 Task Category: None Level: Error Keywords: Classic User: N/A Computer: computername.domain.com Description: The Terminal Server security layer detected an error in the protocol stream and has disconnected the client. Client IP: fe80:0000:0000:0000:e499:f014:83ea:8221.
This occurs because Aero is not supported within a shadowed session. To work around this issue, do not attempt to shadow a client with Aero enabled.
Note: The existence of the Dwm.exe process in the user session indicates that Aero is enabled for that session.
Aero is the name for the enhanced graphics available on Windows Vista, Windows 7, Windows Server 2008 and Windows Server 2008 R2. This feature allows visual elements to implement transparency, Aero Peek, live preview of taskbar items and other features.
Note: Aero is only supported during remote sessions beginning with Windows Server 2008 R2. Any instance of the errors above that does not occur on Windows Server 2008 R2 with Aero enabled cannot be due to the issue described in this article.
Remote Control, also known as shadowing, is the ability to view and interact with an existing RDP session initiated by another user. This would allow an administrator for instance to view or control a user's existing RDP session. More information on Remote Control can be found at the following links: