Guides / Remote Desktop (RDP) won't connect at work

Part of: Work PC problems: updates, apps, printers and remote access

Last reviewed 5 Oct 2026 · By Harry

Remote Desktop (RDP) won't connect at work

RDP can't connect, credSSP errors, or NLA failures? VPN, gateway, firewall and certificate checks before you rebuild the jump box.

Remote Desktop throws "can't connect to the remote computer", sits on Configuring remote session, or dies with a CredSSP / NLA error. The user is at home; the PC is under a desk at the office. These tickets cluster after VPN outages, gateway certificate expiry, and Windows updates that tighten encryption. Guessing "the PC is offline" without a ping wastes the afternoon.

What kind of RDP is it?

• Direct RDP on the LAN or over VPN to a private IP. Needs line of sight on TCP 3389 (or the custom port IT set).
• RD Gateway / Remote Desktop Gateway wraps RDP in HTTPS. Certificate and gateway service matter as much as the target PC.
• Azure Virtual Desktop / Windows 365 are cloud services — check Azure and Microsoft 365 Service health when many cloud desktops fail together.
• Third-party (AnyDesk, TeamViewer, SplashTop) — different products; do not troubleshoot them with mstsc steps.

User checks

1. VPN first. Most office PCs are not on the public internet. Connect the company VPN and confirm internal sites resolve before opening Remote Desktop. See VPN connected but no internet.
2. Correct hostname. Use the FQDN IT documented, not a stale NetBIOS name. Try the IP only as a DNS test.
3. Another network. Phone hotspot through the VPN client (if supported) versus home Wi-Fi. Some ISPs break IPsec; the hotspot proves it.
4. Local console. Ask someone in the office to confirm the PC is powered, not sleeping past Wake-on-LAN policy, and shows a reachable IP.
5. Credentials. Domain username (DOMAIN\user or user@domain), not a local Microsoft consumer account. Locked accounts fail differently from network failures — read the exact dialog.
6. NLA / CredSSP messages. "Authentication error: CredSSP" after updates usually means the client and server patched unevenly (orphan encryption level). IT may need a Group Policy or patch alignment — do not disable NLA on a work PC without approval.

IT checks

• Port and firewall. Test-NetConnection pcname -Port 3389 from a jump host on the same network. No listener = RDP disabled, firewall rule missing, or PC off.
• Remote Desktop enabled on the target and the user in the Remote Desktop Users group (or the group policy that populates it).
• RD Gateway certificate. Expired public cert = every external worker fails at once while on-LAN RDP still works. That split is diagnostic.
• Network Level Authentication and TLS versions. After hardening updates, old clients fail. Update mstsc / Windows on the client.
• Conditional Access / Entra. Cloud PCs and some gateway setups require compliant devices. See device not compliant.
• UDP vs TCP. RDP prefers UDP for responsiveness; blocked UDP falls back to TCP and can feel "stuck". Note it for the firewall team.
• Session limits and shadowing. Console session in use, or GPO forbidding multiple sessions, produces confusing errors. Check Task Manager → Users on the target via another admin path.

Azure Virtual Desktop specifics

When the pool is Azure-hosted, an Azure regional event or a host-pool scaling failure can look like "RDP is down". Check Azure status, the host pool's VM power state, and the broker. Do not rebuild the user profile until a second user on another device fails the same host pool.

When to escalate

Escalate to networking when VPN and gateway health are bad for many users. Escalate to Microsoft when Azure Virtual Desktop or Windows 365 Service health names an incident. Escalate to desktop engineering when one PC has RDP disabled or a stuffed disk. One home user with no VPN is not a datacentre incident.

Related status pages

• Microsoft Azure
• Microsoft 365
• Microsoft Entra ID

Related guides

• VPN connected but no internet or can't reach internal sites
• Conditional Access: device not compliant or not joining
• Chrome ERR_CONNECTION_TIMED_OUT / DNS_PROBE at work

FAQ

Why can't I connect with Remote Desktop from home?

Usually the VPN is not connected, the RD Gateway certificate expired, or the office PC is asleep/offline. Confirm VPN and ask someone on-site to check the PC.

What does a CredSSP error mean?

The client and server disagree on encryption/authentication level, often after uneven Windows updates. Align patches or apply the GPO Microsoft documents — do not turn off NLA without approval.

Is RDP a Microsoft 365 outage?

Classic RDP to an office PC is not. Azure Virtual Desktop and Windows 365 can be — check Azure and Microsoft 365 Service health for those.

Does a commercial VPN app fix RDP?

Only if the blocker is your ISP path and IT allows an alternate tunnel to the gateway. A random consumer VPN will not reach private office IPs.