Remote Desktop can't connect to the remote computer

Khadija Hajjati 40 Reputation points
2026-10-23T17:42:28.0333333+00:00

Remote Desktop Protocol (RDP) connectivity to the server is unavailable. The connection failure may be caused by firewall rules blocking RDP traffic, the server being offline or unreachable, or TCP port 3389 being closed or unavailable. According to Copilot

Windows for business | Windows Server | User experience | Remote desktop clients
0 comments
Answer accepted by question author
Ronald Sabiiti 1,585 Reputation points Independent Advisor
2026-10-23T18:30:40.3666667+00:00

Hello @Khadija Hajjati

Remote Desktop connections can fail if the server is offline, if firewall rules are blocking RDP traffic, or if TCP port 3389 is closed. These conditions prevent the client from establishing a session.

Recommended Steps:

Verify the server is powered on and reachable on the network.

Check firewall settings to ensure inbound RDP traffic (TCP 3389) is allowed.

Confirm the Remote Desktop Services role is running on the server.

Test connectivity with telnet <server> 3389 or Test-NetConnection -ComputerName <server> -Port 3389 to validate port availability.

Helpful references.

If this information was helpful, please click Accept Answer. Doing so helps other community members identify useful solutions to similar issues.

Thank you for choosing Microsoft Q&A!

Was this answer helpful?

1 person found this answer helpful.
0 comments

1 additional answer

Sort by: Oldest
Most helpful Newest Oldest

  1. AI answer

    2026-10-23T17:42:51.3166667+00:00

    Use this sequence to isolate the RDP failure.

    1. Verify the RDP listener is running on the server.
      • Open an elevated Command Prompt and run qwinsta.
      • Expected result: rdp-tcp appears in the Listen state.
      • If rdp-tcp is missing or not listening, check:
        • Remote Desktop Services (TermService) is running.
        • Remote Desktop Services UserMode Port Redirector (UmRdpService) is running.
    2. Verify Remote Desktop is enabled in the registry.
      • Warning: registry changes are risky. Back up the registry before modifying it.
      • Check these values:
        • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp → fEnableWinStation = 1
        • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server → fDenyTSConnections = 0
        • If policy is configured, also check HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services → fDenyTSConnections = 0
      • If both policy and default values exist, both should be 0 for fDenyTSConnections.
    3. Confirm port 3389 is listening and not owned by another process.
      • Run:
        • netstat -anob | findstr 3389
        • tasklist /svc | findstr TermService
      • The PID for TermService should match the PID listening on port 3389.
      • If another application is using 3389, stop or reconfigure that application, then restart Remote Desktop Services.
    4. Check Windows Firewall.
      • Open wf.msc → Inbound Rules.
      • Ensure these rules are enabled for all profiles:
        • Remote Desktop - User Mode (TCP-In)
        • Remote Desktop - User Mode (UDP-In)
      • PowerShell equivalent: 
             Get-NetFirewallRule -DisplayGroup "Remote Desktop" | Set-NetFirewallRule -Enabled True
      • For testing only, the firewall can be temporarily disabled: 
             Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled False
        Re-enable it after testing.
    5. Test network reachability to TCP 3389 from another machine.
      • Use psping: 
             psping -accepteula <computer IP>:3389
      • Or use telnet <servername> 3389.
      • If the port test fails, the issue is network path, firewall, or Azure NSG if the server is in Azure.
    6. If the listener is running and connectivity to the machine is successful, check server-side RDP configuration issues.
      • Delete and re-create the Remote Desktop self-signed certificate:
        • Open Certificates MMC for Computer account.
        • Go to Certificates under Remote Desktop.
        • Delete the RDP self-signed certificate.
        • Restart Remote Desktop Services.
        • Refresh the snap-in and confirm the certificate is re-created.
      • Check for unnecessary Remote Desktop Services roles in Server Manager → Manage → Remove Roles and Features → Server Roles → Remote Desktop Services.
      • If the machine has the Remote Desktop Connection Broker role, confirm:
        • TSSDis is running.
        • In compmgmt.msc → System Tools → Local Users and Groups → Groups → RDS Endpoint Servers, the group contains NT AUTHORITY\NETWORK SERVICE.
    7. Additional checks if the listener is not working.
      • Add Network Service to the local Administrators group, then restart TermService: 
             Add-LocalGroupMember -Group Administrators -Member "Network Service"
      • Check HKEY_LOCAL_MACHINE\SYSTEM\Setup and confirm:
        • SystemSetupInProgress = 0
        • OOBEInProgress = 0
      • If needed, replace the RDP-Tcp registry subkey with the same subkey exported from a working machine with the same Windows version.
        • Warning: deleting this key temporarily prevents RDP access until it is restored.
    8. If the server is in Azure, verify the Network Security Group allows RDP to the subnet or NIC.

    If qwinsta shows rdp-tcp in Listen and port 3389 is reachable, focus on certificate, role, and configuration issues. If port 3389 is not reachable, focus on firewall, NSG, routing, or another process using the port.

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.