Have this issue for several months since moving users from a 2003 virtual terminal server to 2012 standard virtual terminal server. Affects only mobile users via VPN or 1 MPLS branch site.
Server logs do not reveal anything valuable other than the session was disconnected then reconnected. Both a UDP and TCP session is connected.
Packet capture shows either the server sending the TCP RST,ACK packet or the client, thus destroying the connection.
I have enabled TCP Keep-alive on the server with default "1", however, keep-alive packets are not sent every 1 minute (if that's what the value indicates).
I have network detection policy set to treat every connection as a fast connection on the host.
The clients TerminalServices-ClientActiveXCore log indicates 2 things...
1. Multi-transport connection has been disconnected
2. ClientActiveX has been disconnected reason=4.
I cannot find out what reason code 4 refers to and my pcaps do not reveal much to me.