Windows Remote Desktop (RDP) Not Working? Fixes and Security Tips

"Remote Desktop can't connect to the remote computer" has a handful of causes. Go through them in this order and you'll find yours.

1. Can the host even do RDP?

Windows 10/11 Home cannot act as an RDP host. You can connect from Home, but not to it. You need Pro, Enterprise or Education (or a Windows Server).

2. Is Remote Desktop enabled on the host?

Settings → System → Remote Desktop → On. Or from an elevated PowerShell:

Set-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections -Value 0
Enable-NetFirewallRule -DisplayGroup "Remote Desktop"

Check that the service is running and listening:

Get-Service TermService
Get-NetTCPConnection -LocalPort 3389 -State Listen

3. Can the client reach port 3389?

From the client machine:

Test-NetConnection HOST_OR_IP -Port 3389

Look at TcpTestSucceeded:

Result	Meaning
`True`	The network path is fine. The problem is credentials, permissions or settings (steps 5-6)
`False`, host pings	Port blocked, so check the firewall (step 4) or RDP is off
Ping and port both fail	Wrong address, host off/asleep, or a network/NAT problem

For other ways to diagnose this on Linux and Windows, see Diagnose network connectivity step by step.

4. Firewall and network profile

The built-in "Remote Desktop" firewall rules apply to the Domain and Private profiles by default. If the host's network is classified as Public, RDP is blocked. Check and change it:

Get-NetConnectionProfile
Set-NetConnectionProfile -InterfaceAlias "Ethernet" -NetworkCategory Private

Also check your router and any hosting/cloud firewall if you connect from outside the local network.

5. Is the user allowed?

Administrators can connect by default. Other accounts must be in the Remote Desktop Users group:

net localgroup "Remote Desktop Users" USERNAME /add

Also:

Blank passwords are refused for network logons. Give the account a password.
"Your credentials did not work": use the full form COMPUTERNAME\username or .\username. For a Microsoft account use MicrosoftAccount\[email protected] (or just the email address), with the account password, not the PIN.
"Another user is signed in" (Windows client versions allow one session): sign out the other session or accept the prompt that disconnects them.

6. Other common errors

Error	What to check
"An internal error has occurred"	Differences in clock/time, or a certificate problem. Restart Remote Desktop Services, and make sure both PCs have the right time
"The connection was denied because the user account is not authorized for remote login"	Add the user to Remote Desktop Users
"Network Level Authentication" errors	Update both PCs. Do not switch NLA off permanently, since it's a security feature
Connects, then black screen	Update the graphics driver, or disable the GPU-accelerated RDP policy
Works on the LAN, not from outside	Port forwarding/VPN issue, see the security section below

Restart the service on the host if it is misbehaving:

Restart-Service TermService -Force

Security: do not expose 3389 to the internet

An RDP port open to the internet is found and attacked within minutes by automated brute-force bots. Old RDP flaws such as BlueKeep have been exploited in the wild, and exposed RDP is one of the most common ways ransomware gangs get into a network. Safer options:

Connect through a VPN: WireGuard or Tailscale, then RDP to the private address.
RD Gateway or a bastion host for corporate setups.
If you must publish it: keep NLA on, use long unique passwords and MFA, set an account lockout policy, restrict the source IPs in the firewall rule, and keep Windows patched.

Changing the port from 3389 hides it from naive scans but is not real protection.

Quick checklist

Pro/Enterprise edition? RDP enabled?
Test-NetConnection HOST -Port 3389 succeeds?
Network profile Private/Domain, firewall rule enabled?
User in Remote Desktop Users, with a password?
Not exposed to the open internet?