Unable to login using Remote Desktop Connection

Confirm the Azure subscription is Active/Enabled, then reset the VM’s RDP configuration and verify that TCP 3389 is allowed to the VM.

1. Confirm payment reactivation completed

A VM showing Running does not by itself confirm the subscription’s billing state.

1. In the Azure portal, open Subscriptions.
2. Select the subscription containing the VM.
3. Check Status:
   • Active/Enabled: continue to the RDP checks below.
   • Disabled, Past Due, or Expired: open the billing warning and select Settle Balance or Reactivate, as applicable.

After a past-due payment, subscription reactivation can take up to 24 hours. If the payment was processed but the subscription remains disabled, create an Azure Billing support request.^1^ A disabled subscription deallocates its VMs and releases temporary IP addresses; an enabled subscription permits normal resource operations.^2^

2. Download a fresh RDP connection file

The VM’s public IP might have changed after it was deallocated or restarted.

1. Open Virtual machines → select the VM.
2. On Overview, note the current Public IP address.
3. Select Connect → RDP → Download RDP file.
4. Open that new file rather than using an old shortcut or saved address.

If no public IP is displayed and you are not connecting through Azure Bastion, VPN, or ExpressRoute, direct Internet RDP will not work.^3^

3. Reset RDP configuration

Error 0x204 generally indicates that the client did not establish a connection to the RDP service, so reset the service and Windows Firewall configuration before changing credentials.

1. Open the VM in the Azure portal.
2. Go to Help → Reset password.
3. Set Mode to Reset configuration only.
4. Select Update.
5. Wait for completion, then retry using the newly downloaded RDP file.

This operation restores the VM’s Remote Desktop configuration and applicable Windows Firewall rules.^3^

4. Verify network access to port 3389

In the VM resource:

1. Open Networking.
2. Review inbound rules on both the network interface and subnet Network Security Groups.
3. Confirm an inbound rule permits:
   • Protocol: TCP
   • Destination port: 3389
   • Action: Allow
   • Source: preferably your current public IP address
4. Ensure no higher-priority deny rule overrides it.
5. Use Network Watcher → IP flow verify if available to test whether traffic from your public IP to TCP 3389 is allowed.

Do not expose port 3389 to Any unless temporarily required for diagnosis; restrict it to your public IP. Also verify that your local or company firewall permits outbound TCP 3389.^4^

5. If it still fails

Proceed in this order, testing RDP after each action:

1. VM → Boot diagnostics: verify that the screenshot shows the Windows sign-in screen rather than a boot error.
2. VM → Help → Resource health: confirm the VM reports Available.
3. If credentials might be affected, use Help → Reset password, select Reset password, and set a new local administrator password.
4. Select Restart from the VM’s Overview page.
5. Run the resource-specific diagnostic from the portal’s Help (?) area using the VM as the affected resource.
6. Use Redeploy only as a final infrastructure repair. Redeployment moves the VM to another Azure host; ephemeral-disk data is lost and dynamic IP addresses can change.^3^

If the subscription is enabled and these diagnostics do not identify the failure, open an Azure technical support request for the VM and include error code 0x204, extended code 0x0, the last successful connection time, and the diagnostic results—without posting IP addresses or account details publicly.

References

1. Reactivate a disabled Azure subscription
2. Azure subscription states
3. Troubleshoot Remote Desktop connections to an Azure virtual machine
4. Detailed troubleshooting steps for remote desktop connection issues to Windows VMs in Azure