How do I diagnose a Windows Server RDP connection problem?
Separate network reachability from the RDP listener and account policy. If RDP is unavailable, inspect the server through an already authorised console or alternate management path. Do not disable authentication protections to diagnose a failed connection.
Instructions
1. Check the RDP TCP port from Windows
Use the server’s assigned RDP port; 3389 is the usual default.
Test-NetConnection 203.0.113.10 -Port 3389A successful TCP result indicates reachability only. RDP authentication, encryption and account rights still need to succeed.
2. Inspect the server service and listener
Run these inside PowerShell on the Windows server through your alternate access path.
Get-Service TermService
qwinsta.exe
Get-NetTCPConnection -State Listen -LocalPort 3389Review the Remote Desktop service and whether the intended RDP listener is listening. Use the actual port if changed.
3. Check policy and user rights
Review the exact connection error, Windows event logs, allowed remote-logon accounts, Network Level Authentication requirements and both firewall layers. Keep changes specific to the confirmed cause and verify access before ending the alternate session.
Check the result
- The assigned RDP port is reachable from an approved client network.
- The intended authorised user can establish a normal protected RDP session.
Troubleshooting
- The listener works but one user cannot sign in
- Investigate that account’s remote-logon rights, credentials and applicable security policy.
- The server has no working listener
- Review the documented Windows RDP configuration through the console; do not change registry values blindly.
Official references
Use the documentation for your installed version when a flag, service name or platform feature differs.