msrdc.exe randomly stealing focus

[mha42]

Version

10.0.22621.0

WSL Version

• [X] WSL 2
• [X] WSL 1

Kernel Version

5.15.74.2

Distro Version

Ubuntu 22.04

Other Software

Irrelevant, and happens as soon as the WSL instance is started.

Repro Steps

1. Start any WSL instance. In my case I have a WSL v1 started without any WSLg support.
2. Wait
3. Focus is randomly stolen from your application.

I found an app somewhere at some point simply printing what process is currently getting focus. When focus is stolen I see the following line printed;

4300:C:\Program Files\WindowsApps\MicrosoftCorporationII.WindowsSubsystemForLinux_1.0.0.0_x64__8wekyb3d8bbwe\msrdc.exe | Thu 17 November 12:26:04

Often I am having an outlook window open at the time in which I am composing a mail and suddenly I cannot write in it anymore.

Expected Behavior

WSL should not steal focus.

Actual Behavior

Focus is randomly stolen

Diagnostic Logs

N/A

[mha42]

focus.zip

I am attaching the focus tool incl source code.

[scottrudy]

I had this same issue today and used Focus Logger to find the culprit. It's also pointing to WSL's msrdc.exe. I've seen this happen with Notepad before, but today it seems to be related to opening Windows Explorer for me. I ran process explorer prior to starting Windows Explorer and watched several wslhost.exe processes start up, but one specifically fires up a conhost.exe process which then starts the msrdc.exe process, and that steals focus before shutting down. This all happens within seconds or less.

[maxhoesel]

Can confirm this behavior on Windows 11, i had no issues until about 2 days ago. msrdc.exe seems to steal focus for a moment every 2 minutes, kicking me out of fullscreen applications.

The only possible cause that I could think of is that I updated my VirtualBox install from from 6 to 7.X around that time. That could be a red herring though, unless someone else can confirm that correlation.

[mha42]

Can confirm this behavior on Windows 11, i had no issues until about 2 days ago. msrdc.exe seems to steal focus for a moment every 2 minutes, kicking me out of fullscreen applications.

The only possible cause that I could think of is that I updated my VirtualBox install from from 6 to 7.X around that time. That could be a red herring though, unless someone else can confirm that correlation.

I don't run VirtualBox at all here.

[MarcoBrieden]

This problem is driving me absolutely nuts! No matter what I'm using my computer for the focus is lost randomly every couple of minutes. Even trying to shut WSL down doesn't make any difference. I assume if I remove msrdc.exe I'll brick my system, but I really don't know what do do at this point.

Has anyone found any way of fixing this?

/edit: While wsl --shutdown didn't do anything killing the WSL process in the task manger seems to at least give temporary relief until the process gets auto started again, e.g. by using Windows Explorer.

[Lyqed]

Two possible solutions I found are:

1) backup the msrdc.exe file and then delete it.

2) Disable remote credential guard in the group policy editor by:

First going to the local group policy editor, then navigating to Computer Configuration > Administrative Templates > System > Device Guard > Turn on Virtualization Based Security > Choose "Disabled" >Apply and restart pc

[ftvkyo]

Can confirm, Windows 11 Pro, 22H2, 22621.963.

Been wondering what was causing it since November, thought it is from my custom keyboard layout, because one of the symptoms was that the language menu (next to the clock) would disappear in these moments.

[zadjii-msft]

@craigloewen-msft Any updates on this (or the other focus stealing threads)? I'm trying to rule out WSL from the cause of microsoft/terminal#13388, but that's proven... tricky.

[scottrudy]

I just uninstalled everything from my Windows 10 PC and reinstalled it, because it was so unstable. After re-installing I am still seeing the same issue. I can't even add a user to a new distribution because focus is stolen before I can enter a password for a new user.

Using Process Explorer I can see the following hierarchy when the problem occurs:

- wslservice.exe
  - wslhost.exe
    - conhost.exe
    - msrdc.exe
      - msrdc.exe
      - WerFault.exe

Location of msrdc.exe C:\Program Files\WindowsApps\MicrosoftCorporationII.WindowsSubsystemForLinux_1.0.3.0_x64__8wekyb3d8bbwe\msrdc.exe

Command line argument msrdc.exe /v:0C22B93D-1735-409E-86C1-A57BAABA42C2 /hvsocketserviceid:4C7A87FC-FACB-11E6-BD58-64006A7986D3 /silent /wslg /plugin:WSLDVC_PACKAGE /wslgsharedmemorypath:WSL\0C22B93D-1735-409E-86C1-A57BAABA42C2\wslg "C:\Program Files\WindowsApps\MicrosoftCorporationII.WindowsSubsystemForLinux_1.0.3.0_x64__8wekyb3d8bbwe\wslg.rdp"

[rwasef1830]

I've seen crashes in msrdc.exe in this background process when using the "Sound for remote desktop" (https://www.sound-over-rdp.com/) software. The cause of the crash was an issue in a DLL they inject in all processes, seemingly to force the output sound device. There was a way to enable crash memory dumps I think with the global flags tool, if you get such a dump may help narrow down the cause of the crash.

[scottrudy]

The issue I am seeing today shows the following in Problem Details

Source Remote Desktop

Summary Stopped working

Date ‎1/‎18/‎2023 12:45 PM

Status Report sent

Description Faulting Application Path: C:\Program Files\WindowsApps\MicrosoftCorporationII.WindowsSubsystemForLinux_1.0.3.0_x64__8wekyb3d8bbwe\msrdc.exe

Problem signature Problem Event Name: MoAppCrash Package Full Name: MicrosoftCorporationII.WindowsSubsystemForLinux_1.0.3.0_x64__8wekyb3d8bbwe Application Name: praid:msrdc Application Version: 1.2.3575.0 Application Timestamp: 633c8bef Fault Module Name: KERNELBASE.dll Fault Module Version: 10.0.19041.2364 Fault Module Timestamp: 5b7d4d22 Exception Code: c06d007e Exception Offset: 000000000002cd29 OS Version: 10.0.19044.2.0.0.256.4 Locale ID: 1033 Additional Information 1: 3895 Additional Information 2: 3895d839a7fe3f6903b9cbca03bd030e Additional Information 3: 3981 Additional Information 4: 3981f255f8e6b8e54242bfc4bce248e4

Extra information about the problem Bucket ID: 1bdacafa384471b8e7d131b0fc19a97e (0)

[thheller]

This has to be the most infuriating thing I have ever encountered. I can't code in IntelliJ anymore, feels like every other second something is stealing my focus. Using the Focus Logger tool I also identified the "msrdc.exe" as the cause. In the midst of typing some code the focus is just gone, then returns after a few seconds.

I just did a clean install Win11 Pro and did all the updates. Now the Computer is basically unusable.

[thheller]

I found https://github.com/microsoft/wslg/discussions/523, and created the $HOME/.wslconfig (windows home, C:\Users\..\.wslconfig not in linux) with

[wsl2]
guiApplications=false

That at least seems to bring some relief.

[meiskam]

having the same issue

WSL version: 1.0.3.0
Kernel version: 5.15.79.1
WSLg version: 1.0.47
MSRDC version: 1.2.3575
Direct3D version: 1.606.4
DXCore version: 10.0.25131.1002-220531-1700.rs-onecore-base2-hyp
Windows version: 10.0.22621.1105

neither wsl --shutdown nor $HOME/.wslconfig .. guiApplications=false helped

[Salvora]

Same issue here. I noticed that while wathing youtube in full screen. Screen loses focus and after inspecting it, I found that msrdc.exe was stealing the focus randomly.

[comiluv]

I was also informed by WindowsFocusLogger that msrdc.exe is stealing focus from me and googling about the program I came across this issue page. I tried $HOME/.wslconfig .. guiApplications=false and then wsl --shutdown and it seems to have relieved it for me at the moment.

[mha42]

I was also informed by WindowsFocusLogger that msrdc.exe is stealing focus from me and googling about the program I came across this issue page. I tried $HOME/.wslconfig .. guiApplications=false and then wsl --shutdown and it seems to have relieved it for me at the moment.

For my part, this is not applicable as I also have a WSL2 instance for the purpose of running GUI applications :-) What's interesting for me is that despite the WSL instance loaded is WSL1 without any GUI support it causes issues. If a partial fix would appear that only loaded the WSLg components if the distro has it enabled the problem would be a lot more manageable.

[niwazukihon]

This issue is driving me nuts! I updated WSL2 weeks ago and started to get this problem. If it's caused by WSLg then I wish I can disable it since I don't currently use GUI.

[Masamune3210]

Do this if you want to disable WSLg

[fanthos]

When msrdc.exe starts, it should not be get focused if no window shows.

[cool-RR]

I am also experiencing this problem. Windows 10 Pro.

[mbartlett21]

This is also happening for me on Win11 every 20 seconds or so. I tried using bladeSk/StayFocused, which helps a little, but doesn't prevent it completely.

I've also found that while msrdc is focused, it removes my ENG language indicator from the taskbar:

Normal:

While msrdc takes focus:

My tree from Process explorer is:

• wininit.exe
  • services.exe
  • svchost.exe
    • *wslhost.exe -Embedding
  • wslservice.exe
    • *wslhost.exe --mode 2 --vm-id {9c326228-a832-4354-be2b-eabc48ec2636} --handle 3000 ...
    • *wslhost.exe --mode 3 --vm-id {9c326228-a832-4354-be2b-eabc48ec2636} --handle 2060 ...
    • *conhost.exe 0x4
    • *msrdc.exe /v:9C326228-A832-4354-BE2B-EABC48EC2636 /hvsocketserviceid:C25E2050-FACB-11E6-BD58-64006A7986D3 /silent /wslg /plugin:WSLDVC_PACKAGE /wslgsharedmemorypath:WSL\9C326228-A832-4354-BE2B-EABC48EC2636\wslg "C:\Program Files\WindowsApps\MicrosoftCorporationII.WindowsSubsystemForLinux_1.1.3.0_x64__8wekyb3d8bbwe\wslg.rdp"
    • *wslhost.exe --mode 3 --vm-id {9c326228-a832-4354-be2b-eabc48ec2636} --handle 1880 ...
    • *conhost.exe 0x4
  • vmcompute.exe
    • *vmwp.exe 3C82ED2D-396C-40C6-80E7-9EB65CAA7746 0x234
    • *vmmemWSL (Those with an asterisk are processes that only appear when it is taking focus)

wsl --list --running shows that my Ubuntu distro is running while it is stealing focus, and then shows it no longer running immediately after.

I do have my text editor open on one of the files in the Ubuntu distro, but that shouldn't make it steal focus.

My way I found of preventing it stealing focus was to either: A. Don't have my editor looking at files on WSL in the background, or B. Run a program over WSLg and just have it minimised in the background.

[meiskam]

this issue has been happening for 4 months, none of the workarounds help, i've just uninstalled wsl because it's unbearable losing focus this much

[mbartlett21]

@meiskam

Does leaving a program open that is using wslg help? For example, I've got Sublime Merge on WSL open and just minimised in the background, and I haven't had any problems

[hideyukn88]

This sounds dup to https://github.com/microsoft/wslg/issues/998, and the fix went into msrdc.exe, thanks!

[theaquamarine]

Awesome, thanks! Do you know which version of wsl/msrdc will have the fix?

[mamhadu]

This is making using windows a nightmare. Always losing focus on the apps. Is there any workaround available?

[Masamune3210]

You can disable wslg if you don't plan on using GUI apps in WSL, that would eliminate the problem until the fix can be fleshed out and proliferated

[dalinicus]

You can disable wslg if you don't plan on using GUI apps in WSL, that would eliminate the problem until the fix can be fleshed out and proliferated

Experiencing the same issues, and this worked for me. Added a new file .wslconfig to my home directory with the following:

[wsl2] guiApplications=false

After a reboot of wsl, msrdc.exe stopped crashing and pulling away focus.

[WarrenSchultz]

@meiskam

Does leaving a program open that is using wslg help? For example, I've got Sublime Merge on WSL open and just minimised in the background, and I haven't had any problems

Yes, this actually worked perfectly. Thanks for the suggestion! (Popping open xcalc did the trick :)

[GoldenretriverYT]

Having the same issue. Workarounds are fine but imho a fix is really needed. This is so incredibly annoying and interrupting.

[hideyukn88]

@GoldenretriverYT, would you please try the prerelease version of WSL? it can be updated by wsl --update --pre-release, thanks!

[WarrenSchultz]

@hideyukn88

, would you please try the prerelease version of WSL? it can be updated by wsl --update --pre-release, thanks!

I'm checking now to see if it helps with that. The way I've been getting around the issue is to leave a WSL terminal window open at all times. That also solves the issue of this folder filling up with logs.

Unfortunately, the latest WSL pre-release update doesn't solve that issue still.

[hideyukn88]

@WarrenSchultz, I guess what you are seeing is https://github.com/microsoft/wslg/issues/901, would you please share /mnt/wslg/stderr.log and a few of those RdClientAutoTrace files ? thanks!

[WarrenSchultz]

@hideyukn88

@WarrenSchultz, I guess what you are seeing is #901, would you please share /mnt/wslg/stderr.log and a few of those RdClientAutoTrace files ? thanks!

Here, or in the other thread?

[klafredo]

@GoldenretriverYT, would you please try the prerelease version of WSL? it can be updated by wsl --update --pre-release, thanks!

I tried this and the issue still exists..

[hideyukn88]

@WarrenSchultz, please upload here, thanks!

@klafredo, is Linux GUI application working at your environment? Basically, there is two issues here. 1) Linux GUI application works, but when WSL started up, the window focus is moved out "once". 2) Linux GUI application doesn't work (it does not show up on Windows's desktop) and window focus keep losing and often mouse pointer keep blinking, which symptom do you see (or anything-else), thanks!

[klafredo]

@klafredo, is Linux GUI application working at your environment? Basically, there is two issues here. 1) Linux GUI application works, but when WSL started up, the window focus is moved out "once". 2) Linux GUI application doesn't work (it does not show up on Windows's desktop) and window focus keep losing and often mouse pointer keep blinking, which symptom do you see (or anything-else), thanks!

Yes, the GUI works (and is really fast). When I boot up I see the issue (not always). If I then run WSL the issue seems to go away.

here is a sample of what happened today for the Focus app:

5588:C:\Program Files\WindowsApps\MicrosoftCorporationII.WindowsSubsystemForLinux_1.3.11.0_x648wekyb3d8bbwe\msrdc.exe | Fri 21 July 09:50:33 13468:C:\Windows\explorer.exe | Fri 21 July 09:50:43 44092:C:\Program Files\WindowsApps\MicrosoftCorporationII.WindowsSubsystemForLinux_1.3.11.0_x648wekyb3d8bbwe\msrdc.exe | Fri 21 July 09:51:02 13468:C:\Windows\explorer.exe | Fri 21 July 09:51:12 45548:C:\Program Files\WindowsApps\MicrosoftCorporationII.WindowsSubsystemForLinux_1.3.11.0_x648wekyb3d8bbwe\msrdc.exe | Fri 21 July 09:52:05 13468:C:\Windows\explorer.exe | Fri 21 July 09:52:16 13484:C:\Program Files\WindowsApps\MicrosoftCorporationII.WindowsSubsystemForLinux_1.3.11.0_x648wekyb3d8bbwe\msrdc.exe | Fri 21 July 09:52:34 13468:C:\Windows\explorer.exe | Fri 21 July 09:53:00 ... ... 28764:C:\Program Files\WindowsApps\MicrosoftCorporationII.WindowsSubsystemForLinux_1.3.11.0_x648wekyb3d8bbwe\msrdc.exe | Fri 21 July 09:56:44 13468:C:\Windows\explorer.exe | Fri 21 July 09:56:44 28764:C:\Program Files\WindowsApps\MicrosoftCorporationII.WindowsSubsystemForLinux_1.3.11.0_x648wekyb3d8bbwe\msrdc.exe | Fri 21 July 09:56:45 39812:C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.17.11461.0_x648wekyb3d8bbwe\WindowsTerminal.exe | Fri 21 July 09:56:58 13468:C:\Windows\explorer.exe | Fri 21 July 09:56:58 48080:C:\Program Files\WindowsApps\CanonicalGroupLimited.Ubuntu_2204.2.33.0_x6479rhkp1fndgsc\ubuntu.exe | Fri 21 July 09:56:58 ... ... Stops happening

[anthonylowther21]

I use the tool SearchEverything, and it was scanning WSL folders periodically. I turned off the functionality to automatically scan, and the ghost stealing focused finally stopped. It was kicking off a background WSL instance, performing an index, and then closing WSL instance :/

[bvolckae]

Would love to know if a permanent solution is being worked on / has been found. The solutions proposed here still trigger this issue on my machine and it's very annoying to work with to say the least. Strongly considering simply uninstalling WSL.

[LiquidSevens]

I use the tool SearchEverything, and it was scanning WSL folders periodically. I turned off the functionality to automatically scan, and the ghost stealing focused finally stopped. It was kicking off a background WSL instance, performing an index, and then closing WSL instance :/

Good eye @anthonylowther21, that's exactly what was causing the problem for me. Thanks!

[RuszlanG]

Is this issue going to be fixed anytime soon? It has been reported over a year ago, and still no news from the development team.

[WolfspiritM]

For me this is happening very often lately. I'm not sure if it's some tool accessing specific folders or what's causing this but it's very annoying. For me it happens multiple times in a row (maybe 6-7 times in a minute) and then stops for a while (even a few hours) and then happens again. It often happens after unlocking the PC.

EDIT:

As I'm not using gui applications I've now set:

[wsl2]
guiApplications=false

in my .wslconfig ( https://learn.microsoft.com/en-us/windows/wsl/wsl-config ) as mentioned by many comments above And so far msrdc didn't even start. So maybe that's a workaround if gui applications aren't required.

[MartinSoto]

Any chances of a fix for this anytime soon? Is there a workaround that doesn't involve completely killing the support for graphical applications? I need them, so this is not an option for me.

[TobberH]

Okay seriously. It's now 2024 and I also just finally discovered that it's C:\Program Files\WSL\msrdc.exe that kept stealing focus (actually did it WHILE writing this) and it's been driving me insane for a while now! How is this still not resolved?

Edit: I'm running Windows 10 Pro 22H2 and wsl2.

[Spongeloaf]

@TobberH Have you tried any of the suggested workarounds? Yes the problem should still be fixed if possible, but for me the cause (and solution) were the same as @anthonylowther21. I was running voidtools Everything (Which is THE killer app everyone should try out) and excluding my WSL folder fixed the problem. Also, I think it follows from this that if you have any other software that monitors disk activity, they could also cause it. Possibly windows defender? or some other AV suite?

[TobberH]

@Spongeloaf I am actually running Everything, but not sure what folder to exclude in the Indexing config?

Edit: Also tried adding the .wslconfig but that didn't seem to fix anything so far.

[Spongeloaf]

@TobberH This is what I did. Looks like \\wsl.localhost\ is the base path that any WSL instances would be installed at. Also, I've gathered from reading comments here that the .wslconfig fix works in other cases, but not for people running Everything.

EDIT: Added emphasis on the "Attempt to monitor changes" checkbox, as suggested by @jacktose

[hideyukn88]

@TobberH, do you run any Linux GUI application? msrdc.exe is the remoting app which project Linux window on Windows's desktop, thus when the focus is moved to msrdc.exe, it should mean the focus is moved to one of Linux GUI application window, is this the case? Or if this occurs without running any Linux GUI application window, would you please collect some data for us by following below steps, thanks!

1) download foregroundTracing.txt and save as foregroundTracing.wprp at local disk. 2) run wpr -start foregroundTracing.wprp from Windows's command prompt 3) ... wait until the issues occurs, hopefully it occurs within an hour or so, so tracing file won't be too large ... 4) run wpr -stop foregroundTracing.etl 5) share foregroundTracing.etl with us.

[TobberH]

@TobberH This is what I did. Looks like \\wsl.localhost\ is the base path that any WSL instances would be installed at. Also, I've gathered from reading comments here that the .wslconfig fix works in other cases, but not for people running Everything.

Well, I'm not actively scanning any WSL folders, and you can't exclude network folders like \\wsl.localhost\ in the exclude folder options. But I've changed so I'm now only scanning specific folders on my C: drive so it shouldn't hit the wsl folders any more. I'll see if that helps.