MSTSC (win 8.1) crashes after entering credentials

Question

Hello,
I need a bit of help here.
I have 2 windows 8.1 pro English, patched to the latest patches and EMET 4.1 with recommended settings, mallwarebites and System Center Endpoint Protection latest version on it) clients members and domain members.
They cannot connect to other machines (server 2012 R2) within the domain and 1 REMOTE machine running windows 8.1 pro pc (not a domain member) using RDP (mstsc.exe) but they CAN connect to a remote server 2008R2 server in the same remote site (not part
of the domain)
From those same machines I CAN connect to all machines in the domain and remote using the Remote Desktop Connection Manager v 2.2.
From the REMOTE machines mentioned before I CAN connect to the domain servers (win 2012 R2) using the same credentials
So it seems to be caused by something on these machines but I cannot figure out what it is. 
EventID 1000:
Faulting application name: mstsc.exe, version: 6.3.9600.16384, time stamp: 0x5215e2b5
Faulting module name: ntdll.dll, version: 6.3.9600.17031, time stamp: 0x530895af
Exception code: 0xc0000374
Fault offset: 0x00000000000f8c9c
Faulting process id: 0x2380
Faulting application start time: 0x01cf6a32386abe27
Faulting application path: C:\Users\panicz\Desktop\mstsc.exe
Faulting module path: C:\WINDOWS\SYSTEM32\ntdll.dll
Report Id: 7e9a9f8b-d625-11e3-bf11-64315087a136
Faulting package full name: 
Faulting package-relative application ID: 
 EVENT ID: 1001
Fault bucket 85913872471, type 4
Event Name: APPCRASH
Response: Not available
Cab Id: 0
Problem signature:
P1: mstsc.exe
P2: 6.3.9600.16384
P3: 5215e2b5
P4: StackHash_554a
P5: 6.3.9600.17031
P6: 530895af
P7: c0000374
P8: PCH_83_FROM_ntdll+0x000000000009B13A
P9: 
P10: 
I THINK it started after a patch Tuesday in april but am not sure.
Any suggestions?
Thanks!
Panicz

Answer 1

Hi Jeremy,
tried the first step already but to no avail.
Regarding the logs:
Microsoft-Windows-TerminalServices-RDPClient%4Operational
ON SERVER: eventID 226
RDPClient_SSL: An error was encountered when transitioning from TsSslStateDisconnected to TsSslStateDisconnected in response to 25 (error code 0x8000FFFF).
ONCE at march 31 and about 10 on May 4 but nothing after that.
ON CLIENT: RDPClient_SSL: An error was encountered when transitioning from TsSslStateDisconnected
to TsSslStateDisconnected in response to 25 (error code 0x8000FFFF).
once today and once on may 4. However the last entry after a failed and logged attempt is Server supports SSL = supported. then nothing
more
Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin
EMPTY ON BOTH SERVER AND CLIENT and last entry May 4
Microsoft-Windows-TerminalServices-LocalSessionManager%4OperationalOn
server and client: An error occurred when transitioning from Initialized in response to EvCreated. (ErrorCode 0xD00002FE) but in both cases that was on april 16 or longer ago. when setting up a new connection that fails, no additional errors are
logged
Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin
On Server: 0 events
On Client: ONLY events Remote Desktop Services has taken too long to load the user configuration from server. Last entry April 4, 2014 and nothing after that.
Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational
On Server: no errors
On Client: Last entry during an attempt = Server supports SSL = supported.
I tested with a different win 8.1 client with the same user accounts but that works fine. Unless you have some more suggestions, or anyone else for that matter, I will reinstall the laptops and close this matter.
Thanks so far for your support!
Best regards,
Panicz