I'm troubleshooting a recurring RDP error that affects only one user in a Proxmox environment running three Windows Server 2025 virtual machines: a domain controller, a file server, and a terminal server.
The user connects from a fully updated, workgroup Windows 11 Pro workstation over an always-on IPsec IKEv2 VPN and signs in with domain credentials. After working normally on the terminal server, he disconnects his RDP session. When he tries to reconnect, the connection fails with error 0x904 and no additional message appears.
The issue occurs only when connecting to the terminal server. From the same workstation, the user can connect to the domain controller and file server. His session appears as Disconnected on the terminal server, but he cannot reconnect to it or create a new session. Restarting the terminal server restores access temporarily; after the user disconnects again, the problem returns.
No relevant events appear in the terminal server's System, Application, TerminalServices-LocalSessionManager, or TerminalServices-RemoteConnectionManager logs. The domain controller and file server logs are also clean. Other users can connect and reconnect normally, and the affected credentials work from other computers.
I have already tested other accounts from the same workstation, different networks, Bitdefender exclusions, and WatchGuard firewall rules. What could cause this per-user RDP failure, and what should I check before rebooting the server again?
3 Answers
Because the problem follows this user and not the workstation or network, start with the user’s RDP client profile on the Windows 11 machine. Clear the contents of %AppData%MicrosoftTerminal Server Client and remove the user’s HKCUSoftwareMicrosoftTerminal Server Client settings after exporting them if needed. A stale cached certificate or connection setting can cause a failure for only one user.
Also check the client’s CAPI2 operational log for certificate errors around the time of the failed reconnect. On the server, use qwinsta and logoff to inspect or clear the disconnected session instead of rebooting. A session limit or RDS time-limit policy could also leave a disconnected session blocking both reconnection and creation of a new session, so review the applicable Group Policy settings.
The absence of server-side events does make the Windows 11 client worth investigating. Check its TerminalServices client logs, Schannel, CAPI2, and general security-related events at the exact time of the failed reconnect. Those logs may show a certificate, credential, or NLA failure that never reaches the terminal server’s session logs.
Try connecting with the terminal server’s IP address instead of its hostname or FQDN. If that succeeds, investigate DNS resolution and the RDP certificate bound to the server, including whether an expired or mismatched self-signed certificate is being cached by the client.
As a diagnostic test, temporarily disable Network Level Authentication on the terminal server. If the connection works afterward, focus on the NLA authentication path, certificate configuration, and client-side security logs. Re-enable NLA after testing.
Related Questions
Can't Load PhpMyadmin On After Server Update
Redirect www to non-www in Apache Conf
How To Check If Your SSL Cert Is SHA 1
Windows TrackPad Gestures