Quick answer
If the RDP connection is not established, first check if the computer is reachable on the network and if the RDP service is running. Then check firewall rules, user permissions and any certificate errors. In most cases, the problem is resolved by restarting the service or correcting firewall rules.
How to recognize the problem
- Client reports "Remote Desktop can't connect to the remote computer"
- Connection drops immediately after entering the password
- Ping succeeds, but RDP port 3389 does not respond
- A certificate or credential error message appears
- RDP works locally, but not from a remote location
Most common causes
RDP service is not running
The "Remote Desktop Services" service may be stopped or disabled, so the server does not accept connections.
Firewall blocks port 3389
Windows Firewall or a network firewall on the router may block incoming traffic on the RDP port.
User does not have RDP permission
The account must be in the "Remote Desktop Users" group or have the appropriate right in local policy.
Network profile or VPN issue
An incorrect network profile (Public instead of Private) or a disconnected VPN can prevent access.
Invalid certificate or NLA
An expired certificate or a mismatch in Network Level Authentication can interrupt authentication.
Step-by-step fix
- 1
Check basic server availability
From the client computer, run
ping server-nameandping server-IP-address. If ping fails, it does not necessarily mean the problem is with RDP, because ICMP is often blocked; also check availability usingTest-NetConnectionon port 3389. Also check if the server is powered on and if the network cable is connected. - 2
Confirm that RDP is enabled
On the server, run
sysdm.cpland open the "Remote" tab. Make sure "Allow remote connections to this computer" is checked; if not, check it and click "Apply". - 3
Check RDP service status
Open
services.mscand find "Remote Desktop Services". If the status is "Stopped", start the service (right-click > "Start"). Startup type is usually "Manual", because the service starts on demand on the first connection, so this is not an error. Restarting this service interrupts all active RDP sessions. - 4
Check Windows Firewall rules
In
Windows Defender Firewall > Advanced Settings > Inbound Rules, look for the rules "Remote Desktop - User Mode (TCP-In)" and "Remote Desktop - User Mode (UDP-In)". If they are disabled, enable them, but apply them only to Domain and Private profiles; avoid opening RDP on the Public profile. - 5
Check user permissions
Open
lusrmgr.mscorcompmgmt.msc, then add the account that signs in to the "Remote Desktop Users" group. If you use a domain, also check the group in Active Directory. Sign out and sign in again for the changes to take effect. - 6
Test port 3389
From the client, run
Test-NetConnection -ComputerName server-name -Port 3389in PowerShell. If "TcpTestSucceeded" is False, the port is blocked or the service is not listening on it. Also check if any third-party antivirus or firewall is blocking the port. - 7
Check NLA and certificate
In
sysdm.cpl > Remote, uncheck "Allow connections only from computers running Remote Desktop with Network Level Authentication" as a temporary test. If the connection works, the problem is with NLA or the certificate, so re-enable NLA as soon as possible. For the certificate, checkcertlm.msc > Remote Desktopand whether it has expired. - 8
Restart the RDP service and server
If the previous steps did not help, restart the "Remote Desktop Services" service via
services.msc. Keep in mind that a restart interrupts all active RDP sessions, so do this outside working hours. If that does not help either, restart the server, but only if you have another way to access it (console, iLO/iDRAC) and with prior notice to users. - 9
Check network profile and VPN
In
Settings > Network & internet, select the active connection (Ethernet or Wi-Fi) and check "Network profile type"; a more reliable check is theGet-NetConnectionProfilecommand in PowerShell on the server. If you use a VPN, make sure the connection is active and that a route to the server exists. Disconnect and reconnect the VPN and try again.
If nothing helps: advanced diagnostics
If the connection still cannot be established, check Event Viewer on the server (eventvwr.msc) under Windows Logs > System and Applications and Services Logs > Microsoft > Windows > TerminalServices-LocalSessionManager and TerminalServices-RemoteConnectionManager. Look for errors with event IDs related to RDP. Also, temporarily disable antivirus or endpoint protection and test, but re-enable it immediately afterward. If the server is behind NAT, check if the port is forwarded to the correct IP address. For remote locations, check if the provider blocks port 3389. As a last resort, change the RDP port in the registry (HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp\PortNumber), update the firewall rule and restart the service, but before making changes be sure to export (back up) that key, otherwise you may lose RDP access.
How to prevent it
- Regularly update Windows Server and RDP clients.
- Use a VPN or RD Gateway instead of exposing the RDP port directly to the internet.
- Periodically check certificate validity and NLA settings.
- Keep records of membership in the Remote Desktop Users group.
When to call a professional
If you have checked all the listed steps and the problem still persists, or if you do not have administrative access to the server, contact IT support. They can analyze logs, check the network infrastructure and security policies.
IT infrastructure maintenance · Servers, networks, backup, security and helpdeskFAQ
Why does RDP work locally but not from a remote location?
The most common cause is a firewall on the router or an ISP blocking port 3389. Check if the port is forwarded and if traffic from the remote network is allowed.
How do I know if the problem is with the certificate?
If the connection drops immediately after entering the password or a certificate message appears, check the expiration date in `certlm.msc` under "Remote Desktop". Also, temporarily disable NLA and test.
Is it safe to disable NLA?
Disabling NLA reduces security because it allows older clients. Use it only as a temporary test and re-enable NLA after determining the cause.