At a customer site, a Windows 11 workstation has trouble connecting by Remote Desktop to two servers on the same network. One server usually connects after two or three attempts, while the other frequently disconnects with a generic network or firewall error. Strangely, if I connect remotely to that Windows 11 workstation first and then start Remote Desktop from within that session, both servers work normally. Reinstalling Windows and testing another computer did not change the behavior, and I use the same account both onsite and remotely. What network, authentication, security software, or Remote Desktop settings could cause this?
4 Answers
Try disabling the UDP transport for Remote Desktop on the clients and servers, preferably as a temporary test through Group Policy or the appropriate registry setting. Some networks, especially over Wi‑Fi, have unstable RDP sessions when UDP is negotiated, while TCP continues to work.
Compare what changes between the onsite and nested sessions: hostname versus IP address, DNS resolution, SMB access, printers, mapped drives, smart cards, and other redirected resources. Also test connecting by both the server name and its IP. If the results differ, investigate DNS, NTLM/Kerberos authentication, or a security policy affecting one connection path.
Check whether the problem began after a Windows or Windows Server update. There have been patches that affected Remote Desktop Services, authentication, and connection transport. Compare the update history on the workstation and both servers, and review the Remote Desktop and security event logs at the time of a failed connection.
Check whether endpoint protection or the local firewall treats connections originating from the local network differently from those coming through a remote session. The servers may also have security policies that block or restrict local Remote Desktop traffic.
Hostname versus IP is particularly useful to test because name resolution can select a different route or authentication method. A policy blocking NTLM could make one server fail when accessed by name but work through another path.