Fix Remote Desktop connection problems on Windows servers

Remote Desktop problems fall into a few groups: the connection does not reach the server, the sign-in is refused, or the session itself misbehaves. Find your message below. Replace 203.0.113.10 with your server's address.

Before you start

• Check the server's status under Services › My Services and known incidents under Support › Network Status.
• Keep your client up to date: Remote Desktop Connection on Windows comes with Windows Update; on macOS, iOS and Android use the current Windows App.
• Test the port from your computer:

Test-NetConnection 203.0.113.10 -Port 3389

On macOS and Linux use nc -vz 203.0.113.10 3389. TcpTestSucceeded : True means the network path is open; look at the sign-in errors. False means the network, a firewall or the server itself.

"Remote Desktop can't connect to the remote computer"

The client could not reach the service. Work through:

1. Is the address right? Compare with Primary IP on the service page.
2. Is the server restarting? Windows updates can take several minutes after a restart. Wait and try again.
3. Does a firewall rule block you? If you restricted Remote Desktop to certain IP addresses, your own address may have changed. Check your current public IP and the rule; see Windows Defender Firewall rules.
4. Is your network blocking port 3389? Try another network, such as a mobile hotspot.

If you cannot get in at all, use the web console if your service page shows one. In an administrator PowerShell window on the server, enable the built-in Remote Desktop firewall rules again:

Enable-NetFirewallRule -DisplayGroup "Remote Desktop"

On a server installed in another language, the group name may differ; list the rules with Get-NetFirewallRule -DisplayGroup "*Remote*".

"The user name or password is incorrect" or "Your credentials did not work"

• Type the user as Administrator or .\Administrator (the dot means the local computer).
• Paste the password without leading or trailing spaces. Remember that the password from the welcome email no longer works if you changed it.
• Several failed attempts can lock the account for a while if an account lockout policy is set. Wait, or reset the password through the web console.

"An authentication error has occurred… CredSSP encryption oracle remediation"

The client and the server disagree on the security level of the CredSSP protocol, usually because one side is missing updates. Install all updates on your own computer, connect through the web console if you can and install the server's updates too. Do not lower the security policy as a permanent fix.

"The remote computer requires Network Level Authentication"

Your client is too old or not set up for NLA. Update the client (Windows App on macOS and mobile, FreeRDP 3 or a current Remmina on Linux). Keep NLA on: it stops attackers before a full session is created.

"The number of connections to this computer is limited"

Both administrative sessions are in use, often by sessions that were disconnected rather than signed out. Sign in as an administrator; Windows may offer to disconnect another user. Or end old sessions from a PowerShell window on the server:

quser
logoff 2

quser lists sessions with their IDs; replace 2 with the ID of the session to end. Unsaved work in that session is lost. Afterwards, sign out with Sign out instead of closing the Remote Desktop window.

Black screen after signing in

• Wait a minute: the first sign-in after updates can take a while.
• Press Ctrl + Alt + End and choose Task Manager, then Run new task and start explorer.exe.
• Reconnect with a lower resolution or without multi-monitor settings.

When to open a ticket

If the port is closed from every network, the web console fails or the server does not respond at all, open a ticket with the server selected under Related Service. Include the exact error text, the output of Test-NetConnection 203.0.113.10 -Port 3389 and pathping 203.0.113.10, and what changed before the problem started.

Next steps

• Restrict Remote Desktop safely: Windows Defender Firewall rules.
• Harden the server: secure a Windows server.
• Nothing responds? Server unreachable.