msrdc.exe randomly stealing focus

[mha42]

Version

10.0.22621.0

WSL Version

• WSL 2
• WSL 1

Kernel Version

5.15.74.2

Distro Version

Ubuntu 22.04

Other Software

Irrelevant, and happens as soon as the WSL instance is started.

Repro Steps

1. Start any WSL instance. In my case I have a WSL v1 started without any WSLg support.
2. Wait
3. Focus is randomly stolen from your application.

I found an app somewhere at some point simply printing what process is currently getting focus. When focus is stolen I see the following line printed;

4300:C:\Program Files\WindowsApps\MicrosoftCorporationII.WindowsSubsystemForLinux_1.0.0.0_x64__8wekyb3d8bbwe\msrdc.exe | Thu 17 November 12:26:04

Often I am having an outlook window open at the time in which I am composing a mail and suddenly I cannot write in it anymore.

Expected Behavior

WSL should not steal focus.

Actual Behavior

Focus is randomly stolen

Diagnostic Logs

N/A

[mha42]

focus.zip

I am attaching the focus tool incl source code.

[scottrudy]

I had this same issue today and used Focus Logger to find the culprit. It's also pointing to WSL's msrdc.exe. I've seen this happen with Notepad before, but today it seems to be related to opening Windows Explorer for me. I ran process explorer prior to starting Windows Explorer and watched several wslhost.exe processes start up, but one specifically fires up a conhost.exe process which then starts the msrdc.exe process, and that steals focus before shutting down. This all happens within seconds or less.

[maxhoesel]

Can confirm this behavior on Windows 11, i had no issues until about 2 days ago. msrdc.exe seems to steal focus for a moment every 2 minutes, kicking me out of fullscreen applications.

The only possible cause that I could think of is that I updated my VirtualBox install from from 6 to 7.X around that time. That could be a red herring though, unless someone else can confirm that correlation.

[mha42]

Can confirm this behavior on Windows 11, i had no issues until about 2 days ago. msrdc.exe seems to steal focus for a moment every 2 minutes, kicking me out of fullscreen applications.

The only possible cause that I could think of is that I updated my VirtualBox install from from 6 to 7.X around that time. That could be a red herring though, unless someone else can confirm that correlation.

I don't run VirtualBox at all here.

[MarcoBrieden]

This problem is driving me absolutely nuts!
No matter what I'm using my computer for the focus is lost randomly every couple of minutes. Even trying to shut WSL down doesn't make any difference. I assume if I remove msrdc.exe I'll brick my system, but I really don't know what do do at this point.

Has anyone found any way of fixing this?

/edit:
While wsl --shutdown didn't do anything killing the WSL process in the task manger seems to at least give temporary relief until the process gets auto started again, e.g. by using Windows Explorer.

[Lyqed]

Two possible solutions I found are:

1. backup the msrdc.exe file and then delete it.

2. Disable remote credential guard in the group policy editor by:

First going to the local group policy editor, then navigating to Computer Configuration > Administrative Templates > System > Device Guard > Turn on Virtualization Based Security > Choose "Disabled" >Apply and restart pc

[ftvkyo]

Can confirm, Windows 11 Pro, 22H2, 22621.963.

Been wondering what was causing it since November, thought it is from my custom keyboard layout, because one of the symptoms was that the language menu (next to the clock) would disappear in these moments.

[zadjii-msft]

Craig Loewen (@craigloewen-msft) Any updates on this (or the other focus stealing threads)? I'm trying to rule out WSL from the cause of microsoft/terminal#13388, but that's proven... tricky.

[scottrudy]

I just uninstalled everything from my Windows 10 PC and reinstalled it, because it was so unstable. After re-installing I am still seeing the same issue. I can't even add a user to a new distribution because focus is stolen before I can enter a password for a new user.

Using Process Explorer I can see the following hierarchy when the problem occurs:

- wslservice.exe
  - wslhost.exe
    - conhost.exe
    - msrdc.exe
      - msrdc.exe
      - WerFault.exe

Location of msrdc.exe
C:\Program Files\WindowsApps\MicrosoftCorporationII.WindowsSubsystemForLinux_1.0.3.0_x64__8wekyb3d8bbwe\msrdc.exe

Command line argument
msrdc.exe /v:0C22B93D-1735-409E-86C1-A57BAABA42C2 /hvsocketserviceid:4C7A87FC-FACB-11E6-BD58-64006A7986D3 /silent /wslg /plugin:WSLDVC_PACKAGE /wslgsharedmemorypath:WSL\0C22B93D-1735-409E-86C1-A57BAABA42C2\wslg "C:\Program Files\WindowsApps\MicrosoftCorporationII.WindowsSubsystemForLinux_1.0.3.0_x64__8wekyb3d8bbwe\wslg.rdp"

[rwasef1830]

I've seen crashes in msrdc.exe in this background process when using the "Sound for remote desktop" (https://www.sound-over-rdp.com/) software. The cause of the crash was an issue in a DLL they inject in all processes, seemingly to force the output sound device. There was a way to enable crash memory dumps I think with the global flags tool, if you get such a dump may help narrow down the cause of the crash.

[scottrudy]

The issue I am seeing today shows the following in Problem Details

Source
Remote Desktop

Summary
Stopped working

Date
‎1/‎18/‎2023 12:45 PM

Status
Report sent

Description
Faulting Application Path: C:\Program Files\WindowsApps\MicrosoftCorporationII.WindowsSubsystemForLinux_1.0.3.0_x64__8wekyb3d8bbwe\msrdc.exe

Problem signature
Problem Event Name: MoAppCrash
Package Full Name: MicrosoftCorporationII.WindowsSubsystemForLinux_1.0.3.0_x64__8wekyb3d8bbwe
Application Name: praid:msrdc
Application Version: 1.2.3575.0
Application Timestamp: 633c8bef
Fault Module Name: KERNELBASE.dll
Fault Module Version: 10.0.19041.2364
Fault Module Timestamp: 5b7d4d22
Exception Code: c06d007e
Exception Offset: 000000000002cd29
OS Version: 10.0.19044.2.0.0.256.4
Locale ID: 1033
Additional Information 1: 3895
Additional Information 2: 3895d839a7fe3f6903b9cbca03bd030e
Additional Information 3: 3981
Additional Information 4: 3981f255f8e6b8e54242bfc4bce248e4

Extra information about the problem
Bucket ID: 1bdacafa384471b8e7d131b0fc19a97e (0)

[thheller]

This has to be the most infuriating thing I have ever encountered. I can't code in IntelliJ anymore, feels like every other second something is stealing my focus. Using the Focus Logger tool I also identified the "msrdc.exe" as the cause. In the midst of typing some code the focus is just gone, then returns after a few seconds.

I just did a clean install Win11 Pro and did all the updates. Now the Computer is basically unusable.

[thheller]

I found #523, and created the $HOME/.wslconfig (windows home, C:\Users\..\.wslconfig not in linux) with

[wsl2]
guiApplications=false

That at least seems to bring some relief.