This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(128, 8%, 22%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EA%3C/text%3E%3C/svg%3E)
I have a 2022 Server that randomly (usually once daily, no specific time) stops allowing RDP and local logins. It throws an RPC server is unavailable error. Any one still logged in remains in, though they are unable to reset/shut down the server. When attempting to do so via cmd prompt it returns RPC error as well. Any new login get the error after typing in user/PW. Doesn't matter if it's a domain or local account. Only way to get past this is a hard reboot.
After the reboot things return to normal and logins happen just fine. This is a VM running in Nutanix AHV. Things I've tried so far:
Upgrade VirtIO driver
Checked DNS
Checked Time
RPC service is running
Remote Registry isn't running, but it is set to auto start (triggered). Checked other working servers and it was set to this.
Checked this page from MS
UPDATE:
To save everyone some reading, there appear a common factor between a lot of the community. Sentinel1. Some users are reporting uninstalling it has fixed there issue. Others are downgrading versions.
Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question. To protect privacy, user profiles for migrated questions are anonymized.
Thanks, that is good to know. The only change we have had in our environment recently is that we are in the process of switching over to SentinelOne, so I was wondering if there was a correlation between our rollout of SentinelOne and this issue. I haven't seen anything in the logs that definitively points to SentinelOne, but the timing on this issue for us seems more than coincidental.
We are having this issue on several servers. We use SentinelOne. We have been working with them to diagnose. the issue. Have you found a resolution?
Having the same issues on our servers after rolling out S1. I believe S1 is doing something to partially block some functionality of DNS but its just a hunch.
Very Interesting. We have 12 instances of Server 2022 in our lineup and they are all running SentinelOne, but this is the only one that is having this issue.
Likewise, we use SentinelOne in our workstation deployment, but we only have one computer user having trouble. Please keep us posted, I would be very interested to know if you pin something down there.
I've seen the services below getting randomly terminated on all servers having issues. Can you check logs on your servers and see. I wonder if S1 is just axing services and it does it multiple times.
The SysMain service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
The Microsoft Defender Antivirus Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 1000 milliseconds: Restart the service.
The Local Session Manager service terminated unexpectedly. It has done this 1 time(s).