SOLVED: The RDP protocol component X.224 detected an error in the protocol stream and has disconnected the client

If you are seeing this error message it’s probably related to the network card being overloaded:

Event Source: Windows System Event Log
Event ID: 50
The RDP protocol component X.224 detected an error in the protocol stream and has disconnected the client

or

Event ID: 56
The Terminal Server security layer detected an error in the protocol stream and has disconnected the client. 

This does not necessarily mean that the network card is too busy. It more likely means that the NIC is confused and there is one easy solution and one slightly less easy work around.

Fix Event ID 50 and 56 – RDP X.224 Disconnect Errors

This ones pretty simple; Just update the network card drivers.

In my case I was working on an old Windows 2008 R2 server which was using drivers from 2008! That was not good. I was able to get new drivers directly from Intel for our clients Pro 100/1000 NIC, But if that doesn’t work for you, try Finding drivers from your server manufacturer like Dell or HP.

If this is a physical box, you could also consider changing out the network card for something with a more powerful processor and as such as more appropriate for a server, Especially in RDS (Terminal Server).

Work Around Event ID 50 and 56 – RDP X.224 Disconnect Errors

If you can’t get new drivers or new drivers do not resolve the problem just turn off TCP Offload.

What is TCP/IP Offload?

TCP offload is a feature of decent network cards that keeps the processing required to manage TCP/IP packets on the NIC.

Beginning with Windows Vista, the Windows operating system supports the following TCP/IP offload services:

• Checksum tasks
• Applications Internet protocol security (IPsec) offload version 1
• IPsec offload version 2
  • [The IPsec Task Offload feature is deprecated and should not be used.]
• Large send offload version 1
• Large send offload version 2
• Connection offload

Starting in Windows 10, version 2004, Windows also supports UDP Segmentation Offload (USO).

TCP/IP Offload Overview – Windows drivers | Microsoft Learn

If TCP/IP offload is disabled that means that the CPU has to do a lot of work that most network cards can and should do. However, if your network card is overloaded or failing and you can’t update the drivers or replace it easily then just turn off TCP Offload and see if that resolves your problems.

How To Disable TCP Offloading

Disabling TCP Offloading is a simple two step process:

1 – Open a CMD prompt as an Admin and run these two commands

• netsh int tcp set global chimney=disabled
• netsh int tcp set global rss=disabled

2 – Run Regedit.exe and disable netDMA:

• Expand HKEY_LOCAL_MACHINE > SYSTEM > CurrentControlSet > Services > Tcpip > Parameters > EnableTCPA
• Set the value to 0 (zero)
  • If the EnableTCPA key does not exist just create it – it is a DWORD

Then reboot your server.

Note that you’ll never be sure which end of the connection is the one that was actually causing the root problem so you might have to do this on both the client and the server but I would certainly start with the server first.