Remote desktop freeze after 5 to 10 minutes

[JohnyHHH]

Hi,

I'm using ver 0.6.99, host MeshCentral on a local PC and try to remote desktop to agent on another PC in same local network.
The agent is run as temporary mode.
Notice that after certain duration of remote access (5 - 10 minutes), the remote desktop freeze.
However the mouse and keyboard event still able to triggered to remote agent PC.
Check on the event log, the desktop session still running.
When this happen, reconnect (disconnect and connect to the agent again) will shows blackscreen. But the mouse and keyboard event still works to the agent PC.

Need help.. Thanks.

[JohnyHHH]

Tried these settings, but same issue still persist.

[Ylianst]

So. Your using MeshCentral v0.6.99, we are currently at v0.7.48. A lot of things have changed since, I am not sure if we did any fixes for this or not. Are you ok with updating your server and agents?

[JohnyHHH]

I did tried with v0.7.48, and v0.7.44
However it have another issue, where by the remote session always automatically ended in few seconds.
I notice this happened when I Hold mouse click and drag action.

[Ylianst]

What browser are you using? What version of NodeJS are you using?

[JohnyHHH]

Google chrome
node v12.16.1

[JohnyHHH]

I was trying on the v0.7.48
it keeps ended my remote session in few seconds.
After several times of keep reconnect the remote session, my agent goes disappear from my devices page,
and below is what I get from agent log

[2021-01-20 04:29:57 PM] Info: No certificate was found in db
[2021-01-20 04:32:06 PM] FATAL EXCEPTION [meshagent64-3322211_43B66675F4AB1007.exe] @ [FuncAddr: 0x00007ffbb0be1e83 / BaseAddr: 0x00007ff71116ffe0 / Delta: -19858398883]
[RtlGetCurrentServiceSessionId]

[krayon007]

Can you give more details about the machine you are trying to connect to? What version of windows... Are any RDP sessions active at the time? Are you connecting when a user is logged in, or when no users are logged in?

[krayon007]

Also, was a crash dump generated? (it would have a .dmp extension, in the same folder as the agent)

[JohnyHHH]

PC1 - Host MeshCentral
PC2 - Agent run as temporary mode

Both PCs are windows 10.

Win RDP session is running from PC1 to PC2. (as to control the agent startup, the WinRDP session is kept open without minimize/close on it, hence user are logged in to PC2.

May i know how to get the dump? I did not see any dump inside the agent folder. Just .exe, .log, .db and .msh files

[Ylianst]

To turn on agent crash dump system on the server, add the following line to the settings section of the config.json:

"AgentCoreDump": true,

Next time an agent crashes, it should generate a debug file and will go into a "meshcentral-coredumps" folder next to the "meshcentral-data" folder. Once you have a dump file, you can send it to me privately using my contact information here. I will get it to Bryan for debugging. Thanks.

[krayon007]

Normally the agent is supposed to run as LocalSystem, as in order to create an Impersonation Token and spawn a process with it, that run level is requried. It looks like the agent is trying to respawn a child process with a different session ID, but is failing because it is running as user (temp mode). Normally KVM will work fine in temp mode, as long as you don't switch session IDs.... Normally there are only a few things that can trigger this... Login and Logout... And RDP... For example, I've seen with the windows RDP client, if you minimize the client window, it will lock-out access to the session, causing the agent to disconnect from the RDP session, and try to connect to the login session. However, to do that, will require LocalSystem. It sounds like something is locking out the agent from accessing the RDP session.... (assuming you are connecting KVM to the RDP session? I'm a little confused as to what you are doing, since you said you are using WinRDP)

[krayon007]

Also, am I understanding correctly, that you have the Agent running as temp mode, running inside the RDP session? I'll have to ponder that scenario for a bit, as normally temp mode is used when running in the console session, not the rdp session. There are a few scenarios I need to test, becuase I'm not sure how session enumeration will work when the agent is not running as the console session or local system session.

[krayon007]

You don't by chance have a 5-10 minute timeout value for RDP session do you? If you have an rdp session, with the agent running as temp mode, if the session were to idle timeout after 5-10 minutes, that would be a session switch from RDP session to login session... But that session switch would requrie LocalSystem to accomplish.

[JohnyHHH]

To turn on agent crash dump system on the server, add the following line to the settings section of the config.json:

"AgentCoreDump": true,

Next time an agent crashes, it should generate a debug file and will go into a "meshcentral-coredumps" folder next to the "meshcentral-data" folder. Once you have a dump file, you can send it to me privately using my contact information here. I will get it to Bryan for debugging. Thanks.

Thanks, will try again see if I can get the dump or not.

[JohnyHHH]

Also, am I understanding correctly, that you have the Agent running as temp mode, running inside the RDP session? I'll have to ponder that scenario for a bit, as normally temp mode is used when running in the console session, not the rdp session. There are a few scenarios I need to test, because I'm not sure how session enumeration will work when the agent is not running as the console session or local system session.

What I'm trying to do is:
First, I run MeshCentral at PC1.
Then I remotely access using WinRDP from PC1 to PC2, so that I can remotely control PC2 to download MeshAgent.exe, and then run the agent as temporary mode. (I'm doing this because PC2 was not physically located with my side)

The WinRDP session is keep open without close the window or minimize it. Just left it open.

Then I start to use MeshCentral remote desktop to PC2 for testing.

[JohnyHHH]

You don't by chance have a 5-10 minute timeout value for RDP session do you? If you have an rdp session, with the agent running as temp mode, if the session were to idle timeout after 5-10 minutes, that would be a session switch from RDP session to login session... But that session switch would requrie LocalSystem to accomplish.

Hmm.. I'm not sure if there is timeout of RDP session or not? But the RDP session is keep open and it does not logout all the while.

Let me do the test without any RDP session running on the Agent PC. Let's see how it goes.

[kevinh-csalabs]

This disconnection appears it may be the same issue as #2162 for 7.48

[JohnyHHH]

Hi guys,

I made a test on v0.7.48.
This test was remote access to a agent PC without WinRDP running on it.
PC-1 hosted MeshCentral
PC-2 run MeshAgent as temp mode.
Both are Windows 10.

What happens is that, once I connect to the remote desktop, and try to mouse control over the agent PC, the session is ended.
Below is the events log.

The agent is online when session ended. No dump file was generated, as the agent does not crashed right?

[kevinh-csalabs]

Ok, I'm not sure if this is related to the other issue or not then. Our sessions do not mention multiplex and you can definitely move the mouse.

[kevinh-csalabs]

@krayon007 this must be the issue: https://support.cloudflare.com/hc/en-us/articles/115003011431-Error-524-A-timeout-occurred#524error
but I'm not sure why I'm seeing it with the latest version and didn't have trouble before (<=0.7.43. I didn't try anything .44-.47)

[JohnyHHH]

Ok, I'm not sure if this is related to the other issue or not then. Our sessions do not mention multiplex and you can definitely move the mouse.

I was trying to apply "desktopMultiplex": true, in the setting and see if this helps or not.

[JohnyHHH]

Hi guys, any updates on this issue?

[kevinh-csalabs]

@JohnyHHH are you using cloudflare?

[JohnyHHH]

@JohnyHHH are you using cloudflare?

Nope.. I was just running MeshCentral locally.
MeshCentral run in 1 PC, MeshAgent run in another PC. Both are connected thru local network.