Cannot RDP after i restarted my Azure VM (testing environment)

The displayed error requires correcting the account’s Remote Desktop logon rights—or the policy denying those rights—before attempting encryption again.^1^

Restore RDP access without RDP

Use Run Command if your Azure account has permission to execute VM commands and the Azure VM Agent is functioning:

1. In Azure portal, open Virtual machines → your VM → Run command → RunPowerShellScript.
2. For a local account, run the following after replacing LocalUserName:

$user = "LocalUserName"

Get-LocalGroupMember -Group "Remote Desktop Users"
Add-LocalGroupMember `
  -Group "Remote Desktop Users" `
  -Member $user

gpresult /h C:\Windows\Temp\gp-report.html

Run Command supports executing PowerShell inside a Windows VM.^2^

The account must belong to Remote Desktop Users, Administrators, or another group granted Allow log on through Remote Desktop Services. It must also not be covered by an applicable deny policy, because deny rights override allow rights.^1^

3. Retry RDP using the appropriate account format:
   • Local account: VMNAME\username
   • Domain account: DOMAIN\username
     Azure Windows VMs validate local and domain credentials using these respective formats.^3^
4. Once connected, open secpol.msc, then go to Local Policies → User Rights Assignment:
   • Add the appropriate group to Allow log on through Remote Desktop Services.
   • Remove it from Deny log on through Remote Desktop Services if present.
   • Also inspect the corresponding local and network logon allow/deny policies.^1^

If this VM is domain-joined, inspect C:\Windows\Temp\gp-report.html. A domain Group Policy can overwrite the local setting. An authorized domain administrator must correct the controlling GPO under:

Computer Configuration → Policies → Windows Settings → Security Settings → Local Policies → User Rights Assignment

Do not modify domain policy unless authorized to administer that domain.

If Run Command is unavailable or does not resolve it

• Open VM → Help → Serial console and sign in with a local administrator account. Use it to inspect the effective policy and RDP service.
• If the restriction appears NLA-related, use VM → Run command → DisableNLA, restart the VM, and test again. This is temporary: re-enable NLA after correcting the account or policy. The DisableNLA action requires a restart to take effect.^2^
• Check Boot diagnostics. If Windows is not at its normal sign-in screen, treat this as a boot or disk recovery problem rather than an RDP policy issue.
• If Run Command, Serial Console, and VM diagnostics are all unavailable or fail, create an Azure support request before making further disk-encryption changes.

Handle the encryption state separately

Do not immediately re-enable Azure Disk Encryption (ADE). First create a snapshot or backup and establish how decryption was performed.

If decryption was done directly inside Windows with low-level BitLocker commands, Azure’s encryption-extension state can remain inconsistent even though the guest reports 100% decrypted. Microsoft documents that this can prevent correct status reporting or VM provisioning.^4^

Only if you confirm that:

• this VM used ADE, and
• decryption was not completed through the ADE management operation,

normalize the state in this order:

Disable-AzVMDiskEncryption `
  -ResourceGroupName "MyResourceGroup" `
  -VMName "MyVM" `
  -VolumeType "all"

Remove-AzVMDiskEncryptionExtension `
  -ResourceGroupName "MyResourceGroup" `
  -VMName "MyVM"

Do not run these commands if ADE decryption already completed correctly. Disabling encryption starts background BitLocker decryption; allow it to finish before removing the extension or enabling encryption again.^5^

ADE is scheduled for retirement on September 15, 2028, so it should not automatically be selected again for a new encryption design. Check the VM’s previous encryption model first: a VM that has ever used ADE has documented restrictions involving migration to encryption at host or server-side encryption with customer-managed keys.^5^

References

1. "The system administrator has restricted the types of logon" error when connecting to a computer
2. Run scripts in your Windows VM by using action Run Commands
3. Troubleshooting specific RDP error messages to a Windows VM in Azure
4. Azure Disk Encryption troubleshooting guide
5. Azure Disk Encryption scenarios on Windows VMs