iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Repair a failed Windows Remote Desktop (RDP) connection in layers: verify the computer name and network path, confirm that Remote Desktop is enabled, check the two RDP services, test the listener and port, repair the Windows and network firewalls, then resolve Network Level Authentication (NLA) and logon-rights issues. This order prevents you from changing security settings when the real fault is DNS, a stopped service, or a blocked port.
Keep NLA enabled in normal environments. If you need access from outside a local network, use a VPN or an RD Gateway design rather than publishing an unprotected RDP endpoint directly to the internet.
How the RDP connection works
A successful connection must pass several independent checks. The client must resolve the destination name or reach its IP address; the host must be awake and configured to accept Remote Desktop; the RDP services must be running; an RDP listener must be bound to the expected port; every firewall between client and host must allow the traffic; and the account must pass NLA and Windows logon-rights checks. A failure at any earlier layer can look like an authentication problem, so test in this sequence.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- Name and network: the client reaches the intended computer over the correct route.
- RDP enablement and policy: Remote Desktop is enabled and not denied by local or domain policy.
- Services: Remote Desktop Services (
TermService) and Remote Desktop Services UserMode Port Redirector (UmRdpService) are running. - Listener and port: the RDP listener is active and reachable on its configured TCP port (3389 by default).
- Firewalls: Windows Defender Firewall, perimeter firewalls, and cloud network security groups allow the required traffic.
- Authentication and authorization: NLA succeeds and the user has the right to log on through Remote Desktop Services.
Before changing anything
Collect the connection details
- Record the exact computer name, fully qualified name if one is used, and current IP address.
- Note whether the client and host are on the same LAN, connected through a VPN, separated by a site-to-site firewall, or using a cloud virtual network.
- Identify whether the host is a Windows client edition or Windows Server edition and whether you have local-administrator or domain-administrator credentials.
- Write down the error text and whether the failure occurs before the credential prompt, after credentials are entered, or while the session is being created.
Make one change at a time and retest. A service restart is usually easy to undo; changing policy, registry values, or internet exposure has a larger security and operational impact.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.
1. Confirm the target and network path
Verify that the host is available
Confirm that the computer is powered on, awake, connected to the expected network, and not in a sleep state that prevents remote wake-up. If you are assisting someone at the site, have them confirm the host’s local IP address rather than relying on an old record.
Separate name-resolution problems from RDP problems
Try the host name first, then its IP address. A name that fails while the IP address works points to DNS, suffix, or NetBIOS resolution rather than to the RDP service itself.
- Open PowerShell or Command Prompt on the client.
- Resolve the name with
nslookup <computer-name>and compare the returned address with the host’s actual address. - Test basic reachability with
ping <computer-name>orping <ip-address>. A blocked ping does not prove that RDP is unavailable, because many networks deliberately block ICMP. - Test the RDP port directly:
Test-NetConnection -ComputerName <computer-name-or-ip> -Port 3389.
Microsoft identifies TCP 3389 as the default RDP port, but a firewall can block it and an administrator can configure another port. A failed name lookup needs DNS or hosts-file correction; a successful lookup with a failed port test moves the investigation to enablement, the listener, or a firewall.
2. Confirm that Remote Desktop is enabled
Use the supported Windows interface
- Sign in locally or through another management channel with an account that can change system settings.
- Open Settings and go to System > Remote Desktop on supported Windows client editions, or open the applicable Remote Desktop configuration in Windows Server.
- Turn on Remote Desktop and accept the confirmation prompt.
- Review the displayed computer name and the list of accounts permitted to connect.
- Leave Network Level Authentication enabled unless you are performing a short, controlled compatibility test.
On managed computers, a local setting can be overridden by domain or local Group Policy. If the switch is unavailable, reverts after a refresh, or conflicts with a security baseline, inspect policy rather than repeatedly changing the user interface.
Check policy and registry state
When policy or registry settings are suspected, verify that fEnableWinStation is 1 and fDenyTSConnections is 0. Check both the normal Terminal Services configuration and the policy location when applicable; a policy value takes precedence over a default value. The exact registry location depends on the setting and Windows edition, so use the policy editor and the Terminal Server/WinStations entries shown on the affected host rather than copying values from a different system.
After correcting a domain policy, run gpupdate /force during an approved maintenance window, then recheck the effective setting. Do not delete policy keys to force a result: the next domain refresh can restore them, and you may remove an organization-wide security control.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
3. Check the two Remote Desktop services
Inspect service status
The core services are Remote Desktop Services (TermService) and Remote Desktop Services UserMode Port Redirector (UmRdpService). A stopped or failed service can leave the host reachable on the network while RDP itself refuses connections.
- Open PowerShell as an administrator.
- Run
Get-Service -Name TermService,UmRdpService. - Confirm that both services show a running state. Record any error shown in the
StatusorDisplayNamefields. - If a service is stopped and policy permits a restart, use
Start-Service -Name TermServiceorStart-Service -Name UmRdpService. - If a running service appears unresponsive, schedule a controlled restart with
Restart-Service -Name TermService. Existing sessions can be disrupted, so warn users first.
You can perform the same check in services.msc. Open the service properties to review its startup configuration and dependencies. Do not set services to unusual startup modes merely to make a single test pass; preserve the organization’s baseline and investigate repeated failures in Event Viewer.
Use service evidence to choose the next step
- Both services stopped: return to Remote Desktop enablement and policy. A policy refresh or feature configuration may have disabled them.
- TermService fails to start: inspect the System and TerminalServices-related event logs, recent updates, and dependency errors before changing the firewall.
- Services run but the port test fails: inspect the listener binding and every firewall layer.
- Services run and the port test succeeds but logon fails: move to NLA, account membership, and user-rights checks.
4. Verify the listener and port
Confirm the default port
TCP 3389 is the default RDP port. From another computer, run Test-NetConnection -ComputerName <host> -Port 3389. A result with TcpTestSucceeded : True proves that a TCP path to that port exists; it does not prove that credentials or NLA will succeed.
Investigate a custom port or port conflict
If the organization changed the RDP port, determine the configured value from the host’s RDP listener settings and test that value instead. Connect with host-and-port syntax, such as server.example:3390, when the client supports it. The listener configuration and the matching TCP and UDP firewall rules must use the same port.
Check whether another process owns the expected port. On the host, use commands such as Get-NetTCPConnection -LocalPort 3389 -State Listen and correlate the owning process with Get-Process -Id <owning-process-id>. If the RDP listener is absent or another application has claimed the port, correct the listener configuration or remove the conflict during a maintenance window. Do not simply open an additional public port; changing the number does not provide meaningful protection by itself.
Retest from the correct network segment
A local test can succeed while a remote test fails because a site firewall, VPN route, or cloud security group blocks the path. Test from the same network location as the affected user, then test locally on the host only when you need to distinguish a listener problem from a transit problem.
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
5. Repair Windows Firewall rules
Enable the built-in Remote Desktop rules
Windows Defender Firewall includes inbound rules grouped as Remote Desktop. The important entries normally include Remote Desktop – User Mode (TCP-In) and Remote Desktop – User Mode (UDP-In). Enable only the profiles and scopes required by your network design.
- Press
Win+R, enterwf.msc, and press Enter. - Select Inbound Rules.
- Locate the rules whose display group is Remote Desktop.
- Open each relevant rule, choose Enable Rule, and review the Profiles, Scope, and Protocols and Ports tabs.
- Ensure the rule’s port matches the listener. If the host uses a custom port, the default 3389 rule will not be sufficient.
The documented PowerShell approach is:
Get-NetFirewallRule -DisplayGroup "Remote Desktop" | Set-NetFirewallRule -Enabled True
Run it in an elevated PowerShell session and then narrow the profiles or remote-address scope if your policy requires it. Enabling every profile for every source address is a quick diagnostic, not a sound permanent configuration.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteCheck firewalls beyond the host
Inspect the client network firewall, site-to-site appliances, VPN concentrator, router access-control lists, and cloud network security groups. Each layer must permit the selected TCP port; if UDP transport is used by the deployment, its corresponding rule must also be allowed. A cloud security-group rule can override a permissive Windows rule, and a Windows rule cannot repair a missing route.
Temporarily disabling a firewall can isolate a cause only during controlled testing with an authorized administrator, a short time limit, and an immediate re-enable plan. The permanent repair is a correctly scoped allow rule, not an unattended firewall shutdown.
6. Resolve Network Level Authentication failures
What NLA changes
NLA authenticates the user before Windows creates a full remote session. Microsoft describes it as adding an extra layer of security to Remote Desktop connections. Keeping this pre-authentication step enabled reduces exposure to unauthenticated session creation and should be the normal configuration.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
Recognize an NLA-specific symptom
NLA is a likely factor when the host is reachable, the RDP listener accepts the connection, and the failure occurs immediately after credentials are submitted or reports that the client cannot complete the authentication requirement. Older clients, incompatible credential providers, time skew, and policy differences can cause this pattern. A network timeout is not an NLA diagnosis; return to the port and firewall checks first.
Free tools Windows power users keep installed
One-click scans. No signup required.
Use a temporary compatibility test
- Confirm that the account and network path are otherwise correct.
- On the host, open the Remote Desktop settings and temporarily clear the option requiring Network Level Authentication, or apply the approved equivalent policy change.
- Test once from the affected client.
- If the connection succeeds, update the client, credential components, or policy that caused the incompatibility.
- Restore NLA immediately and retest. Record the exception and its duration if change control requires it.
Disabling NLA is a diagnostic exception, not a permanent workaround. If the connection still fails with NLA disabled, the underlying problem is more likely service state, listener, firewall, account authorization, or another policy.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.7. Check account membership and logon rights
Confirm that the account is allowed
The user must be a member of the local Remote Desktop Users group or an administrator group permitted by the host’s policy. On a domain, nested-group membership and domain-controller replication can affect the effective result. Verify the account’s current membership on the target host, not only in a directory-management console.
Check the user-rights assignments
Open secpol.msc on a standalone computer, or inspect the applicable domain policy, and review:
- Allow log on through Remote Desktop Services: the user or an allowed group must be present.
- Deny log on through Remote Desktop Services: an explicit deny takes precedence over an allow and can block a user who is otherwise a member of Remote Desktop Users.
- Policy precedence: a domain Group Policy Object can overwrite local settings after the next refresh.
After changing membership or policy, sign out and back in where necessary, refresh policy, and allow directory replication time. Test with a known-authorized account only for diagnosis; do not grant broad administrator rights as a substitute for correcting the intended group or user-rights assignment.
Distinguish authorization from credential errors
A reachable host that rejects one user while another authorized user can connect indicates account, group, rights, lockout, or credential issues rather than a firewall fault. Review the host’s Security and TerminalServices event logs for the rejected account, time, and reason. Avoid repeated guesses that can trigger account lockout.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
8. Secure access from outside the local network
Prefer a VPN or RD Gateway
For users outside the corporate or home network, Microsoft documents VPN and RD Gateway designs for reaching internal resources. A VPN places the client on an authorized network path; RD Gateway places a gateway and authentication step in front of internal desktops. Both approaches avoid exposing the internal RDP listener directly to the public internet.
Why direct internet exposure is a poor repair
Forwarding TCP 3389, or a different public port, to a workstation may appear to solve a reachability problem but leaves the authentication service exposed to unsolicited traffic. Port changes do not replace access control, NLA, patching, monitoring, and gateway policy. If external access is required, involve the network and security owners, restrict source networks where feasible, require strong authentication, and document the approved gateway or VPN route.
Choose the least risky fix
| Observed fault | Typical fix | Privilege normally required | Security impact | Reversibility |
|---|---|---|---|---|
| Name resolves incorrectly | Correct DNS, suffix, hosts entry, or use the verified IP while DNS is repaired | Network or DNS administrator for shared records | Low when records are corrected accurately | High |
| Remote Desktop disabled | Enable Remote Desktop and add the intended account or group | Local administrator or delegated policy administrator | Opens a managed service; keep NLA and scope access | High |
| TermService or UmRdpService stopped | Start or restart the affected service and investigate recurring failures | Local administrator | Usually low; active sessions may be interrupted | High |
| Listener absent or wrong port | Correct listener settings and matching firewall rules | Local administrator | Changing ports alone does not improve security | Medium |
| Windows firewall blocks RDP | Enable and scope the Remote Desktop TCP/UDP inbound rules | Local administrator or policy administrator | Limits exposure when profiles and source scope are correct | High |
| Transit firewall or cloud security group blocks traffic | Add a narrowly scoped rule for the approved listener and source network | Network or cloud administrator | Can expose a service beyond its intended segment if too broad | High |
| NLA incompatibility | Update the client or credential components; disable NLA only for a controlled test | Local or policy administrator | Disabling NLA reduces protection | High if promptly restored |
| User denied at logon | Correct Remote Desktop Users membership and allow/deny user-rights assignments | Local or domain administrator | Improves least-privilege access when groups are used | High |
| Need access from the internet | Use an approved VPN or RD Gateway architecture | Network, identity, and server administrators | Stronger boundary than direct RDP exposure | Medium |
Symptom-based troubleshooting branches
“Remote Desktop can’t connect” or a timeout
- Test the name and then the IP address.
- Run
Test-NetConnectionagainst the configured port. - If the port test fails, check the listener, Windows Firewall rules, VPN route, site firewall, and cloud security group.
- If the port test succeeds, inspect service state, RDP enablement, and account authorization.
“The specified network name is no longer available” or name-related errors
Resolve the name with nslookup and compare it with the host’s current address. Correct stale DNS or suffix settings before changing RDP policy. Use the verified IP only as a temporary diagnostic when name resolution is the confirmed fault.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsCredentials are rejected immediately
Check NLA compatibility, system time, account lockout, password status, Remote Desktop Users membership, and the allow/deny user-rights assignments. A successful TCP test does not grant logon permission.
The connection works with NLA disabled
Restore NLA after the test, then update the older client or credential component and reconcile local and domain policy. If an exception is unavoidable, restrict it to the smallest approved scope and document the compensating controls.
One user works but another does not
Compare group membership, explicit deny rights, effective policy, account status, and the target host’s security events. Do not broaden firewall rules when the evidence points to authorization.
A local connection works but a remote one fails
Inspect the network path between the two locations. The host firewall may be correct while a VPN route, perimeter ACL, or cloud network security group blocks the remote source address.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Quick Recap
Post-repair validation
Use this checklist after each change:
- The tested name resolves to the intended host, or the verified IP is used with a documented DNS issue.
- The host is awake and Remote Desktop is enabled for the applicable Windows edition and policy.
TermServiceandUmRdpServiceare running.- The RDP listener is bound to the expected port, and no unrelated process owns it.
Test-NetConnectionsucceeds from the user’s actual network path.- Remote Desktop inbound rules are enabled only for the required profiles, ports, and source scope.
- Intervening firewalls and cloud security groups permit the same approved traffic.
- NLA is enabled unless a documented, temporary compatibility exception is active.
- The user has the required group membership and allow right, with no applicable deny right.
- External users enter through the approved VPN or RD Gateway path rather than a directly exposed RDP endpoint.
- The final configuration and any temporary changes are recorded for the next administrator.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
