RDP Not Connecting? Fixes for Common Windows VPS Remote Desktop Errors

When Remote Desktop fails, the message on screen is often vague. The good news: almost every RDP failure falls into one of four layers. The network path, the Remote Desktop service, authentication, or sessions and licensing. Check them in that order. Each step rules out one layer, so you stop guessing.

The commands below are for Windows Server 2019, 2022 and 2025. Replace 203.0.113.10 with your VPS IP address and 198.51.100.25 with your own public IP.

Step 1: Can you reach port 3389 at all?

The generic error "Remote Desktop can't connect to the remote computer for one of these reasons" means the client got no usable answer. In the Windows App on macOS or mobile, the same problem usually shows as error code 0x204. Before you change anything on the server, test the port from your own computer. On Windows:

Test-NetConnection 203.0.113.10 -Port 3389

On macOS or Linux:

nc -vz 203.0.113.10 3389

If the result is TcpTestSucceeded : True (or "succeeded" from nc), the network is fine. Skip to Step 3. If it fails, something between you and the server blocks the connection, or nothing is listening. Check these first:

• Your own network. Some office, hotel and public Wi-Fi networks block outbound port 3389. Try once from a different connection, such as a phone hotspot, before you blame the server.

• A custom port. If RDP was moved to another port, connect with 203.0.113.10:3390 (use the port you set) and test that port instead.

• The server state. A VPS that is installing updates, stuck at boot, or was shut down from inside Windows will not answer. Check its status in your control panel and restart it if needed. Updates can take a while after a restart, so give it a few minutes before the next test.

Step 2: Get in another way and check the RDP service

If the port is closed, you need access that does not depend on RDP: a console in your provider's panel if one is available, or the support team. Once you have a session, open PowerShell as Administrator and run:

# Is the Remote Desktop service running?
Get-Service TermService

# Is anything listening on 3389?
netstat -ano | findstr :3389

# Are remote connections allowed? 0 = allowed, 1 = denied
Get-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections

# Which port is RDP configured to use?
Get-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name PortNumber

To turn RDP back on and re-enable the built-in firewall rules:

Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections -Value 0
Enable-NetFirewallRule -DisplayGroup "Remote Desktop"
Restart-Service TermService -Force

Restarting TermService drops every RDP session, so run it from the console, not from an RDP window you still need. The display group name "Remote Desktop" is localized on non-English Windows; use Get-NetFirewallRule -DisplayGroup *Remote* to find it.

The built-in rules only cover port 3389. If you moved RDP to a custom port, you need your own rule:

New-NetFirewallRule -DisplayName "RDP custom port" -Direction Inbound -Protocol TCP -LocalPort 3390 -Action Allow

Step 3: Authentication errors

"Your credentials did not work"

The password is not always the problem. On a standalone VPS the account is local, so type the user name as .\Administrator. The .\ prefix tells the client to use a local account on the server, not a domain or Microsoft account. Also check that your keyboard layout matches the password, and remove old saved credentials after a password change:

cmdkey /list
cmdkey /delete:TERMSRV/203.0.113.10

"The user account has been locked because there were too many logon attempts"

An RDP port that is open to the whole internet gets constant password-guessing traffic. Bots can trigger the lockout policy and lock you out of your own account. Wait for the lockout period to end, or unlock the account from the console in lusrmgr.msc (Users, open the account, clear "Account is locked out"). To see the failed attempts:

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625} -MaxEvents 20 | Format-List TimeCreated, Message

The lasting fix is to allow RDP only from addresses you trust:

Set-NetFirewallRule -DisplayGroup "Remote Desktop" -RemoteAddress 198.51.100.25

If your home IP changes often, this rule can lock you out too. Keep another way in (console or support) before you apply it, or allow a small range you control.

"The connection was denied because the user account is not authorized for remote login"

Members of Administrators can connect by default. Other accounts must be in the Remote Desktop Users group:

Add-LocalGroupMember -Group "Remote Desktop Users" -Member "username"

"An authentication error has occurred. The function requested is not supported"

If the message also mentions "CredSSP encryption oracle remediation", the client and server disagree about CredSSP security updates. The right fix is to install current Windows updates on both sides. A Group Policy setting can relax the check to "Vulnerable", but that re-opens a known weakness. Use it only as a short, temporary step to reach the server and patch it.

"The remote computer requires Network Level Authentication"

Network Level Authentication (NLA) checks your credentials before Windows builds a session, which protects the server from a lot of unauthenticated load. This error usually means an old client. Update the client instead of turning NLA off on the server.

Step 4: Session and licensing messages

"Select a user to disconnect so that you can sign in"

Without the Remote Desktop Session Host role, Windows Server allows two concurrent administrative sessions. Disconnected sessions still count. List the sessions and sign out the ones you do not need:

quser
logoff 2

Use the session ID that quser shows. If you need more than two people working at the same time, that is a licensing question (the RDS role plus RDS CALs), not a setting to change.

"There are no Remote Desktop License Servers available to provide a license"

This appears when the Remote Desktop Session Host role is installed and its 120-day grace period has ended without a configured license server and CALs. You can usually still connect for administration:

mstsc /admin /v:203.0.113.10

Then decide: if you only need admin access, remove the role (Uninstall-WindowsFeature RDS-RD-Server, then restart). If you need multi-user access, configure licensing properly and confirm with your provider how licences are supplied on hosted servers.

Black screen after sign-in

This often happens right after updates while the profile is still loading. Wait a minute. If it stays black, press Ctrl+Alt+End and choose Sign out, then reconnect. Turning off "Persistent bitmap caching" on the client's Experience tab also fixes some cases.

Step 5: Frequent drops and slow sessions

If the connection works but drops every few minutes, look at the network first. RDP uses UDP when it can, and some networks handle UDP badly. You can force TCP on the client with the policy "Turn Off UDP On Client" (Computer Configuration, Administrative Templates, Windows Components, Remote Desktop Services, Remote Desktop Connection Client). Then check the server itself in Task Manager. A VPS with RAM near 100% or a CPU pinned by one process will feel like a bad connection, even when the network is fine.

Quick reference

Symptom	Likely layer	First check
Can't connect / 0x204	Network or service	Test-NetConnection to port 3389
Credentials did not work	Authentication	User name as .\Administrator, saved credentials
Account locked	Authentication	Event 4625, restrict RDP by IP
CredSSP / NLA errors	Client or server updates	Windows Update on both sides
Select a user to disconnect	Sessions	quser and logoff
No license servers available	RDS licensing	mstsc /admin, then fix or remove the role

Run it on IM HOST

IM HOST Windows VPS RDP plans start at $8.99/month (2 cores, 4GB RAM) with full Administrator access over RDP, across 13 plans. If you want dedicated vCPU and RAM with a free automatic backup every 3 days, look at Cloud VPS, which runs Windows or Linux. Both come with 24/7 engineer support who can help when RDP will not answer, no setup fees and a 30-day money-back guarantee. Plans are available in all our locations, subject to stock; we confirm the location before activation.