diff --git a/scripts/base/protocols/rdp/main.bro b/scripts/base/protocols/rdp/main.bro
index c4309e3686..1f120d1b98 100644
--- a/scripts/base/protocols/rdp/main.bro
+++ b/scripts/base/protocols/rdp/main.bro
@@ -100,7 +100,7 @@ event log_record(c: connection, remove_analyzer: bool)
 	  verify_rdp(c);
 
 	  # Remove the analyzer if it is still attached.
-          if ( remove_analyzer && disable_analyzer_after_detection && c$rdp?$analyzer_id )
+          if ( remove_analyzer && disable_analyzer_after_detection && connection_exists(c$id) && c$rdp?$analyzer_id )
             {
             disable_analyzer(c$id, c$rdp$analyzer_id);
             delete c$rdp$analyzer_id;