Troubleshoot Windows Server Remote Desktop failures by checking TermService, listeners, firewall rules, NLA and network connectivity.
Start with Test TCP 3389 and work through the six diagnostic checks in order.
Record results before changing configuration and validate the original symptom after each controlled change.
Quick checks
Start with the basic checks in this runbook before moving to deeper troubleshooting.
- Confirm the affected service or component is available.
- Check recent configuration or connectivity changes.
- Run the relevant commands and compare the result with the expected state.
Test TCP 3389
Confirm the client can reach the server's configured RDP port.
Check Remote Desktop service
Verify the Remote Desktop Services service is running.
Check the RDP listener
Confirm the server is listening on TCP 3389 or the approved custom port.
Check Windows Firewall
Review Remote Desktop firewall rules for the active network profile.
Check NLA and policy
Validate Network Level Authentication, security policy and domain authentication requirements.
Check sessions and event logs
Review existing sessions, system resources and Remote Desktop event logs when network tests succeed but login still fails.
Useful commands
Run these checks from an appropriate administrative session and replace example values with your environment.
RDP port
Test-NetConnection <server> -Port 3389RDP service
Get-Service TermServiceQuick troubleshooting path
Use this sequence to isolate the failing dependency before changing production configuration.
- Test TCP 3389 → Confirm the client can reach the server's configured RDP port.
- Check Remote Desktop service → Verify the Remote Desktop Services service is running.
- Check the RDP listener → Confirm the server is listening on TCP 3389 or the approved custom port.
- Check Windows Firewall → Review Remote Desktop firewall rules for the active network profile.
- Check NLA and policy → Validate Network Level Authentication, security policy and domain authentication requirements.
- Check sessions and event logs → Review existing sessions, system resources and Remote Desktop event logs when network tests succeed but login still fails.
What good troubleshooting looks like
Good infrastructure troubleshooting is evidence-driven. Capture the original state, test the dependency that can prove or disprove your hypothesis, make the smallest safe change and repeat the original test.
Symptom → hypothesis → direct test → result → controlled change → validation → documentation