RDM crash from time to time (direct close without Messages)

Hello Andreas,

Thank you for contacting us on that matter!

As per the information you have provided us, this issue is caused by a Faulting module in Windows:

Faulting module path: C:\WINDOWS\SYSTEM32\ntdll.dll

Per the information we have gathered on that matter, this issue is tied to Windows and not RDM itself.
For this reason, the only thing we can suggest is to run the following tools:

1-Run the .Net Framework Repair Tool: https://www.microsoft.com/en-ca/download/details.aspx?id=30135
2-Run SFC Scannow - https://support.microsoft.com/en-us/kb/929833

For more information on that matter, please refer to this external link:
https://answers.microsoft.com/en-us/windows/forum/all/app-crash-with-ntdlldll/9aa59f80-99a1-4f3c-b2f0-7eb72df05b2a

Best regards,

Thanks James

Not sure if DotNet Libs are really broken on a fresh installed Computer, but i will do some Checks and try if the Problem still happens.

Btw, it looks like that the Problem appears on embedded Web Sessions in RDM.

Best Regards,
Andreas

Hey James

I've just tested several Things with Repairs and the known MS Steps which all never worked since 2000s.
It may be a Problem together with RDM and dotNet, but not sure if dotNet itself is the Problem, because no other Applications are crashing and i can count more than 15 other Peoples in our Company with the same Problem (only with Embedded Browser Tabs).

Can you please do some researches on your Side? Its relative easy to reproduce:

1. Create some Embedded Web Sessions
2. Open and close them, switch between other Sessions and then between other Applications (in example between Outlook and RDM)

I've absolutely no chances to troubleshoot RDM any deeper then via Event Log...

Thanks,
Andreas

Hello Andreas,

Thank you for your swift reply!

I will try to reproduce this issue on my end and get back to you with my results. I happen to use many embedded web sessions every day so adjusting to fit this scenario should be pretty easy.

Best regards,

Sounds great, thanks a lot James! I really appreciate your help.
What im not sure is, if the Problem only exists when using the Connection through a VPN Connection (we only have Sessions through SSH VPN's).

Best Regards,
Andreas

Hello,

Perfect! Would it be possible for you to provide me with more details about the configuration of your SSH Tunnel? Is it using the "Secure Gateway" feature? Is it configured in your web entry directly or are you using a separate entry that is simply linked under the "VPN/SSH/Gateway" of your web entry?

Best regards,

Hello,

Perfect! Would it be possible for you to provide me with more details about the configuration of your SSH Tunnel? Is it using the "Secure Gateway" feature? Is it configured in your web entry directly or are you using a separate entry that is simply linked under the "VPN/SSH/Gateway" of your web entry?

Best regards,

Yes of course.

We are using location specific SSH Tunnels, which will be connected via specified Port and Credentials.
Every SSH Tunnel will be opened trough a central SSH Gateway (also a SSH Tunnel which will be authenticated via Credentials).

In other Words:
Each Session has VPN/SSH/Gateway configured to a specific SSH VPN:




The VPN itself has configured outgoing tunnel settings and a gateway:




So the connection will be established like this:
RDM/Client -> SSH Gateway -> SSH Tunnel -> Destination

The Web Session Object is configured with the original internal IP and Port which needs to be accessed.

Please let me know if you need more Informations.

Best Regards,
Andreas

Hello Andreas,

Thank you for this information! I will add it to our test environment and see if I am able to replicate these crashes.
Do not hesitate to contact us again if you find more information that might prove useful to this case.

Best regards,

Hey James

Do you have any Updates?

The whole Company has this Problem on my Side.
Sometimes more, sometimes less. But every time when the User has Web Sessions opened. Without Web Sessions, it seems to run completely stable.

Me and a colegue we also completely reinstalled our Whole machines with 21h2 and 22h2. On both OS Versions the same after fresh install. So im pretty sure its not a Dotnet Issue itself, but RDM creates a Dotnet Error.
Everytime the same Error:

Faulting application name: RemoteDesktopManager.exe, version: 2022.3.21.0, time stamp: 0x8a079b6b
Faulting module name: ntdll.dll, version: 10.0.22621.755, time stamp: 0x8a328c67
Exception code: 0xc0000374
Fault offset: 0x000000000010c249
Faulting process id: 0x0x1324
Faulting application start time: 0x0x1D8FD7F1C958444
Faulting application path: C:\Program Files\Devolutions\Remote Desktop Manager\RemoteDesktopManager.exe
Faulting module path: C:\WINDOWS\SYSTEM32\ntdll.dll
Report Id: c9005168-cc12-4a0d-b6db-f6bcd0201999
Faulting package full name: 
Faulting package-relative application ID: 

Best Regards,
Andreas

Hello Andreas,

Unfortunately, we are still unable to reproduce this issue on our end. That being said, I would like to collect more information to test deeper and see what we can find.

Does all of your web sessions go through your SSH Gateways? If you open a web session that does not go through it, do you still experience these crashes?

Also, would it be possible for you to enable the SSH logging on one of your SSH Tunnel and provide us with the logs that are generated when the crash occurs? To do so, please go into the properties of your entry, under the "Logs" tab, check the "Enable logging" option, choose a path to save your logs, and set the "Verbose" to 3.

Best regards,

Hi James

I've just enabled the SSH Log, but it dont looks like that this is the Problem. See the Log attached (i have removed sensitive data).

The Crash just happened 07:42:03


Application Logs still empty:


I've opened the Web entry, clicked some, changed Focus from RDM to local Browser, got a new Coffee and after i came back, RDM was closed (crashed).

Most Web Entries are Sophos Firewall Webinterfaces.
Without SSH VPN, it looks stable (so far), but i cannot guarantee that, because all of our sessions are through SSH VPN and ive tested without Sophos Webinterface.

Tests on our Citrix Environment without SSH VPN looks stable so far, but i also cannot guarantee that, ive tested about 30 minutes.

My Environment right now:
RDM Enterprise 2022.3.21.0
Working with DVLS 2022.3.4.0
OS: Win11 22H2 Build 22621.819

Best Regards,
Andreas

Hello,

Sorry for the delay in my reply. I have been trying to find cases similar to yours and reproduce this issue on our end.

At this time, I suspect that this issue might be triggered by the interaction of your Citrix Environment and your web sessions that go through your SSH VPN. That being said, we do not have access to that kind of environment which in turn prevents me from testing this scenario.

Do you have access to an RDM instance outside of your Citrix environment that has a similar configuration? If so, are you able to reproduce this issue with it?

Best regards,

Hi James

Only about 5% of our Employees works with Citrix.
Everything else has RDM local installed.
We have also many different Hardware Types and many different OS Versions (Win10 with different Builds, Win11 with different Builds, Server 2019).
The Problem exists on every instance (local and Citrix).

With which dotNet Version do you Test? And with which OS Version? Which RDM Version?
Maybe i can launch a Test with the same specs.

Thanks,
Andreas

Hello Andreas,

In that case, we can at least remove the Citrix environment from the equation, that's great!

My .Net version is 4.8.04084, haven't upgraded to .Net 6 yet. As for my OS version, I am on version 22H2 (OS Build 19045.2251) with RDM 2022.3.24.0 (fresh instance).
Would it be possible for you to record this test and send us the video using the secure link I will provide you via private message? That way, I will be able to validate that I have followed the same steps on my end.

Thank you for your cooperation on this case.

Best regards,

Hey James

Thanks for the Informations.
I will try to reproduce it in a Video and come back to you.

Best Regards,
Andreas

Hey James

As i wrote already via PM with all details, ive uploaded a short 5min video which demonstrates 2 crashes.

Looking forward for a fix!

Best Regards,
Andreas

Hello Andreas,

Sorry for the delay and thank you for all the details you have provided us so far.

I have consulted your recording and I will request a test environment for Sophos XG Firewalls and try to reproduce these issues.
Until this issue is reproduced on our end and a fix is found, I would recommend opening these connections using the "External" display to avoid crashes.

Happy holidays!

Best regards,

Hi James

Thanks for your Effort.

External Display doesnt work on Web Sessions over VPN, just FYI.
But it looks like that the Problems only exists with the configured Edge Browser.
When i setup the Session to Chrome, it doesnt Crash and also Links in new Tabs are working.

Can you please verify that?

Thanks,
Andreas

Hello Andreas,

Another user reported a similar issue. Our QA team has a task to verify the issue, I have added the information from this post, as well as your last remark to see if they can pinpoint the issue.

We will get back to you once we hear back from them!

Best regards,

Hey James
Hey Richard

Are there any Updates on your Side?

The Problem still exists with all integrated Browsers.

Current Versions:
RDM: 2022.3.35.0
DVLS: 2022.3.13.0

The Problem is really tough and makes Web Sessions almost unusable, because 90%+ of all Web Sessions are Sophos Firewalls on our Side.

Thanks and best Regards,
Andreas

Hello Andreas,

The QA team has been unable to replicate the issue, unfortunately. They would like to know what antivirus software you are using; it may help them reproduce it.

Best regards,

Hey Richard

Interesting, because we tested it also on fresh installed Devices without Antivirus Software.
But we're using Sophos Endpoint Protection in our Environment.

Best Regards,
Andreas

Hello Andreas,

Thank you for your reply! I will provide this information to our QA department and get back to you as soon as I will have an update to provide.

Best regards,

Hey James

Is there maybe the possibility that we have Problem because of special Settings for specific Browsers only?
Im asking, because we're generating all Sessions via Script (Users dont have edit rights), and Web Sessions are still not supported.

Im generating Web Object by cloning a Template and modify the Body.
On generating the Template, we used Chrome as default Browser which allowed us the Setting "Ignore certificate errors":


After changing the Browser to Edge (Default), several Options are not available anymore in RDM, but still set in the Backend on the Object itself:


Here are the specific differences of Get-DSEntry -EntryId $EntryId -AsRDMConnection

Newly created Web Object without settings specified:

ConnectionSubType : Default
ConnectionType    : WebBrowser
CreatedBy         : user
CreationDateTime  : 2023-03-09T16:47:22
Group             : 1. Credentials
ID                : 3d924728-9539-4e32-9884-eeea15a329b4
Name              : New Website Name
OpenEmbedded      : true
VPN               : @{EnableAutoDetectIsOnlineVPN=False; Mode=Inherited}
Web               : 
WebBrowserUrl     : https://www.google.ch

Our Template with some settings (notice the date, ive allready recreated the web object in January):

ConnectionSubType      : Default
ConnectionType         : WebBrowser
CreatedBy              : user
CreationDateTime       : 2023-01-03T12:58:42
CredentialConnectionID : 1310CF82-6FAB-4B7A-9EEA-3E2E451CA2CF
DisplayVirtualDesktop  : Default
Group                  : 2. Sessions
ID                     : 00f4f12b-9376-4723-8f17-3b0b54db6c05
OpenEmbedded           : true
SharedTemplate         : true
TemplateName           : _Website Entry
VPN                    : @{EnableAutoDetectIsOnlineVPN=False; Mode=Inherited}
Web                    : @{IgnoreCertificateErrors=true}
WebBrowserUrl          : https://www.google.ch

A Entry created by the template, which is causing almost nonstop Crashes:

ConnectionSubType             : Default
ConnectionType                : WebBrowser
CreatedBy                     : d2a11ddf-4dd2-49e9-a336-bd785c69bd26
CreationDateTime              : 2022-09-28T13:47:07
CredentialConnectionID        : 41b3f7b1-3a6d-4756-b8bf-563cc1980225
CredentialConnectionSavedPath : 1. Credentials\Sophos XG (interxion)
Description                   : Sophos XG310 Interxion Firwall On-Premises
DisplayMonitor                : Primary
Group                         : 2. Sessions\Interxion
ID                            : 80a2cc3e-8462-4ae9-951b-4a6b1ab6a827
Image                         : ***image-string***
ImageMD5                      : 3cdba6a8d7e89b7a8650273409f53a1a
MetaInformation               : @{AllowMultipleConnections=True; CustomFieldEntities=}
Name                          : Sophos XG (interxion)
OpenEmbedded                  : true
Status                        : {B299F468-BC24-43cb-9417-4FEDFC813E7C}
Tools                         : @{AllowCredentialsToToolsAddOn=true; CredentialSource=CurrentSession; IntelAMTCredentialSource=CurrentSession}
UpdateDateTime                : 2023-01-20T10:43:41
UpdatedBy                     : Automation Account
VPN                           : @{Application=Inherited; EnableAutoDetectIsOnlineVPN=False; MicrosoftVPNUseDefaultGatewayOnRemoteNetwork=false; Mode=Inherited}
Web                           : @{IgnoreCertificateErrors=true}
WebBrowserUrl                 : https://internal.ip:4444

Creating entries via the "NonSupportedEntry" way: devolutions-server/NonSupportedEntry.ps1 at main · Devolutions/devolutions-server · GitHub
But it crashes also when i create a new entry via "Add from Template" Function or when i create a new Website Entry without Template (just tested it again).
Loading the Landing Page of the XG Firewall is enough to get RDM crashing (like in the already sent video).

Best Regards,
Andreas

Hello Andreas,

Thank you for these details, I will provide them to our QA department and get back to you once we will have news to provide.
So far, we have been unable to reproduce crashes tied to the ntdll.dll module.

Is it possible to validate in Sophos Endpoint Protection if any RDM's processes are being closed or interrupted abruptly by the tool?

Best regards,

Hey James

No, there are no Events in Sophos Endpoint Protection.
I think there are no Impacts with Sophos Endpoint in general, because we have also other Clients with Microsoft Defender via MSC which has the same Problem.

Best Regards,
Andreas

Thank you, I will add this to the ticket as well.

Hello

We still encounter the same Issue when opening Browser Sessions via SSH VPN on Sophos Firewalls on RDM 2023.2.28.0.
Are there any News?

Best Regards,
Andreas

Hello Andreas,

Unfortunately, we are still unable to reproduce these crashes on our end.

Best regards,