I'm asking this in Windows Server sub-forum because my actual host OS Windows 10 does not have a dedicated Hyper-V sub-forum.
Late last year I was running a couple of Windows 10 client VMs on my home desktop PC to test Windows Autopilot and MDM. I would access my home computer from outside via RDC and had no problems operating the VMs (Virtual Machine Connection).
This year, I'm not exactly sure what's changed, but it seems like accessing the VM display console cannot succeed. Either the VMC window would get stuck resizing the window to the VM's desktop resolution and eventually close by itself, or it'd hang with corrupted display.
There are corresponding crash events in Application log.
Log Name: Application
Source: .NET Runtime
Date: 15/1/2020 15:22:16
Event ID: 1026
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: HYPERVHOST
Description:
Application: VmConnect.exe
Framework Version: v4.0.30319
Description: The process was terminated due to an unhandled exception.
Exception Info: exception code c0000005, exception address 00007FFA5C994060
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name=".NET Runtime" />
<EventID Qualifiers="0">1026</EventID>
<Level>2</Level>
<Task>0</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2020-01-15T07:22:16.616712500Z" />
<EventRecordID>42127</EventRecordID>
<Channel>Application</Channel>
<Computer>HYPERVHOST</Computer>
<Security />
</System>
<EventData>
<Data>Application: VmConnect.exe
Framework Version: v4.0.30319
Description: The process was terminated due to an unhandled exception.
Exception Info: exception code c0000005, exception address 00007FFA5C994060
</Data>
</EventData>
</Event>
Log Name: Application
Source: Application Error
Date: 15/1/2020 15:22:16
Event ID: 1000
Task Category: (100)
Level: Error
Keywords: Classic
User: N/A
Computer: HYPERVHOST
Description:
Faulting application name: VmConnect.exe, version: 10.0.18362.1, time stamp: 0xa8d2f2dc
Faulting module name: atidxx64.dll, version: 26.20.15003.5016, time stamp: 0x5df7d2d3
Exception code: 0xc0000005
Fault offset: 0x0000000000014060
Faulting process id: 0x32b4
Faulting application start time: 0x01d5cb7481d2a7df
Faulting application path: C:\WINDOWS\system32\VmConnect.exe
Faulting module path: C:\WINDOWS\System32\DriverStore\FileRepository\c0349841.inf_amd64_d70567d658937ff8\B349895\atidxx64.dll
Report Id: e506f08b-f1b7-418f-a14e-5a7df056b38a
Faulting package full name:
Faulting package-relative application ID:
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Application Error" />
<EventID Qualifiers="0">1000</EventID>
<Level>2</Level>
<Task>100</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2020-01-15T07:22:16.833742200Z" />
<EventRecordID>42128</EventRecordID>
<Channel>Application</Channel>
<Computer>HYPERVHOST</Computer>
<Security />
</System>
<EventData>
<Data>VmConnect.exe</Data>
<Data>10.0.18362.1</Data>
<Data>a8d2f2dc</Data>
<Data>atidxx64.dll</Data>
<Data>26.20.15003.5016</Data>
<Data>5df7d2d3</Data>
<Data>c0000005</Data>
<Data>0000000000014060</Data>
<Data>32b4</Data>
<Data>01d5cb7481d2a7df</Data>
<Data>C:\WINDOWS\system32\VmConnect.exe</Data>
<Data>C:\WINDOWS\System32\DriverStore\FileRepository\c0349841.inf_amd64_d70567d658937ff8\B349895\atidxx64.dll</Data>
<Data>e506f08b-f1b7-418f-a14e-5a7df056b38a</Data>
<Data>
</Data>
<Data>
</Data>
</EventData>
</Event>
Worse is if that corrupt VMC window appears, I could very well lose RDC connection to my computer.
I have to get back home to re-gain access to the OS via physical monitor displays. In the physical logon session, I have connect and vmconnect.exe can render the VM screens. The error below probably explains the RDC failure.
Log Name: System
Source: Microsoft-Windows-DriverFrameworks-UserMode
Date: 15/1/2020 17:21:51
Event ID: 10110
Task Category: User-mode Driver problems.
Level: Critical
Keywords:
User: SYSTEM
Computer: HYPERVHOST
Description:
A problem has occurred with one or more user-mode drivers and the hosting process has been terminated. This may temporarily interrupt your ability to access the devices.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-DriverFrameworks-UserMode" Guid="{2e35aaeb-857f-4beb-a418-2e6c0e54d988}" />
<EventID>10110</EventID>
<Version>1</Version>
<Level>1</Level>
<Task>64</Task>
<Opcode>0</Opcode>
<Keywords>0x2000000000000000</Keywords>
<TimeCreated SystemTime="2020-01-15T09:21:51.166245800Z" />
<EventRecordID>29917</EventRecordID>
<Correlation />
<Execution ProcessID="952" ThreadID="700" />
<Channel>System</Channel>
<Computer>HYPERVHOST</Computer>
<Security UserID="S-1-5-18" />
</System>
<UserData>
<UMDFHostProblem xmlns="http://www.microsoft.com/DriverFrameworks/UserMode/Event">
<LifetimeId>{b125172c-e769-468f-ac22-28b8331ebce8}</LifetimeId>
<Problem>8</Problem>
<DetectedBy>2</DetectedBy>
<ActiveOperation>0</ActiveOperation>
<ExitCode>1879048193</ExitCode>
<Message>0</Message>
<Status>4294967295</Status>
</UMDFHostProblem>
</UserData>
</Event>
Log Name: System
Source: Microsoft-Windows-DriverFrameworks-UserMode
Date: 15/1/2020 17:21:51
Event ID: 10111
Task Category: User-mode Driver problems.
Level: Critical
Keywords:
User: SYSTEM
Computer: HYPERVHOST
Description:
The device Microsoft Remote Display Adapter (location (unknown)) is offline due to a user-mode driver crash. Windows will attempt to restart the device 5 more times. Please contact the device manufacturer for more information about this problem.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-DriverFrameworks-UserMode" Guid="{2e35aaeb-857f-4beb-a418-2e6c0e54d988}" />
<EventID>10111</EventID>
<Version>1</Version>
<Level>1</Level>
<Task>64</Task>
<Opcode>0</Opcode>
<Keywords>0x2000000000000000</Keywords>
<TimeCreated SystemTime="2020-01-15T09:21:51.195286600Z" />
<EventRecordID>29918</EventRecordID>
<Correlation />
<Execution ProcessID="952" ThreadID="700" />
<Channel>System</Channel>
<Computer>HYPERVHOST</Computer>
<Security UserID="S-1-5-18" />
</System>
<UserData>
<UmdfDeviceOffline xmlns="http://www.microsoft.com/DriverFrameworks/UserMode/Event">
<LifetimeId>{b125172c-e769-468f-ac22-28b8331ebce8}</LifetimeId>
<FriendlyName>Microsoft Remote Display Adapter</FriendlyName>
<Location>(unknown)</Location>
<InstanceId>SWD\REMOTEDISPLAYENUM\RDPIDD_INDIRECTDISPLAY&SESSIONID_0001</InstanceId>
<RestartCount>5</RestartCount>
</UmdfDeviceOffline>
</UserData>
</Event>
And even worse scenario is when I get the corrupted VMC window, lose connection, and cannot even get into the OS via physical means; the monitors keep sleeping and waking with blank screens. I might be able to connect to the VMs via RDC Manager (with VM mode) from another computer to interact and shut them down, but since the host OS is inaccessible at this state I have to hard reset the computer.
I later found scores of display driver restarts, and even broken dwm.exe which likely explains the loss of physical access.
Log Name: System
Source: Display
Date: 15/1/2020 22:31:50
Event ID: 4101
Task Category: None
Level: Warning
Keywords: Classic
User: N/A
Computer: HYPERVHOST
Description:
Display driver amdkmdap stopped responding and has successfully recovered.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Display" />
<EventID Qualifiers="0">4101</EventID>
<Level>3</Level>
<Task>0</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2020-01-15T14:31:50.403185900Z" />
<EventRecordID>30166</EventRecordID>
<Channel>System</Channel>
<Computer>HYPERVHOST</Computer>
<Security />
</System>
<EventData>
<Data>amdkmdap</Data>
<Data>
</Data>
</EventData>
</Event>
Log Name: Application
Source: Application Error
Date: 15/1/2020 22:31:53
Event ID: 1000
Task Category: (100)
Level: Error
Keywords: Classic
User: N/A
Computer: HYPERVHOST
Description:
Faulting application name: dwm.exe, version: 10.0.18362.387, time stamp: 0x8e064b77
Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000
Exception code: 0xe0464645
Fault offset: 0x0000000000000000
Faulting process id: 0x4718
Faulting application start time: 0x01d5cbb05c00d5c0
Faulting application path: C:\WINDOWS\system32\dwm.exe
Faulting module path: unknown
Report Id: 350b442b-5588-4cee-a1ca-cf09d0254be7
Faulting package full name:
Faulting package-relative application ID:
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Application Error" />
<EventID Qualifiers="0">1000</EventID>
<Level>2</Level>
<Task>100</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2020-01-15T14:31:53.223643800Z" />
<EventRecordID>42330</EventRecordID>
<Channel>Application</Channel>
<Computer>HYPERVHOST</Computer>
<Security />
</System>
<EventData>
<Data>dwm.exe</Data>
<Data>10.0.18362.387</Data>
<Data>8e064b77</Data>
<Data>unknown</Data>
<Data>0.0.0.0</Data>
<Data>00000000</Data>
<Data>e0464645</Data>
<Data>0000000000000000</Data>
<Data>4718</Data>
<Data>01d5cbb05c00d5c0</Data>
<Data>C:\WINDOWS\system32\dwm.exe</Data>
<Data>unknown</Data>
<Data>350b442b-5588-4cee-a1ca-cf09d0254be7</Data>
<Data>
</Data>
<Data>
</Data>
</EventData>
</Event>
Log Name: Application
Source: Dwminit
Date: 15/1/2020 22:32:00
Event ID: 0
Task Category: None
Level: Warning
Keywords: Classic
User: N/A
Computer: HYPERVHOST
Description:
The Desktop Window Manager process has exited. (Process exit code: 0x000000ff, Restart count: 1, Primary display device ID: )
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Dwminit" />
<EventID Qualifiers="32770">0</EventID>
<Level>3</Level>
<Task>0</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2020-01-15T14:32:00.717644300Z" />
<EventRecordID>42332</EventRecordID>
<Channel>Application</Channel>
<Computer>HYPERVHOST</Computer>
<Security />
</System>
<EventData>
<Data>0x000000ff</Data>
<Data>1</Data>
<Data>
</Data>
</EventData>
</Event>
Source: Application Hang
Date: 15/1/2020 22:33:20
Event ID: 1002
Task Category: (101)
Level: Error
Keywords: Classic
User: N/A
Computer: HYPERVHOST
Description:
The program dwm.exe version 10.0.18362.387 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Security and Maintenance control panel.
Process ID: 3fdc
Start Time: 01d5cbb044188c04
Termination Time: 20308
Application Path: C:\Windows\System32\dwm.exe
Report Id: 0d04efe7-c646-4105-aa35-9c80142c42ea
Faulting package full name:
Faulting package-relative application ID:
Hang type: Unknown
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Application Hang" />
<EventID Qualifiers="0">1002</EventID>
<Level>2</Level>
<Task>101</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2020-01-15T14:33:20.564026400Z" />
<EventRecordID>42352</EventRecordID>
<Channel>Application</Channel>
<Computer>HYPERVHOST</Computer>
<Security />
</System>
<EventData>
<Data>dwm.exe</Data>
<Data>10.0.18362.387</Data>
<Data>3fdc</Data>
<Data>01d5cbb044188c04</Data>
<Data>20308</Data>
<Data>C:\Windows\System32\dwm.exe</Data>
<Data>0d04efe7-c646-4105-aa35-9c80142c42ea</Data>
<Data>
</Data>
<Data>
</Data>
<Data>Unknown</Data>
<Binary>55006E006B006E006F0077006E0000000000</Binary>
</EventData>
</Event>
Seems like I'm forced to work with Hyper-V only through physical display now. What is it about Hyper-V services and components that can make it (now) unsuitable for control over RDC?
The melody of logic will always play out the truth. ~ Narumi Ayumu, Spiral