So, my knowledge on Remote desktop services is not so good, but I managed to get it up and running last year, it's been working just fine for eight months. Now today no Remote desktop users can login. Console sessions are working fine though. I checked and the licensing is okay, no errors. But users trying to login are logged in the security log such:

EVENT ID: 4625

Log Name: Security

Source: Microsoft-Windows-Security-Auditing

Date: xxxxxxxx

Event ID: 4625

Task Category: Logon

Level: Information

Keywords: Audit Failure

User: N/A

Computer: xxxxxxxxx


An account failed to log on.


Security ID:                 NULL SID

Account Name:                      -

Account Domain:                            -

Logon ID:                            0x0

Logon Type: 3


To narrow it down I followed this tip to get logging running in the netlogon.log-file https://social.technet.microsoft.com/Forums/windowsserver/en-US/1001bb80-c490-4ec6-828a-9090588c570c/cannot-remote-desktop-into-windows-2008-server-eventid-4625?forum=winserverTS

My log shows the following:

03/11 22:38:44 [LOGON] [3000] SamLogon: Network logon of domain\user from client Entered

03/11 22:38:44 [CRITICAL] [3000] NlPrintRpcDebug: Couldn't get EEInfo for I_NetLogonSamLogonEx: 1761 (may be legitimate for 0xc000006d)

03/11 22:38:44 [LOGON] [3000] SamLogon: Network logon of domain\user from client Returns 0xC000006D

When searching on the [CRITICAL] part of the above log it looks like it has to do with the wrong DC is answering or something. We used to have a BDC but it is gone since long. I can't figure it out, Any suggestions?

4 Answers 4


We are also experiencing the exact same problem since a few days. Try setting the security level in the RDP-Tcp settings to RDP Security Layer instead of negotiate or SSL. That (temporarily) fixed it for us. Must be a Windows update or so...

  • Interesting. However I can confirm no update (neither Windows or third-party) was applied before it stopped working and after.
    – jtheman
    Mar 13, 2015 at 10:35

Try to check if DC's and user machines has correctly synchronized time. If so, check your RDP setting and try to disable NTLM authentication. Another thing can be that some profiles are broken (because of some migration when SID's are gone), did you tried create new profile and connect to RDP with sufficient privileges to RDP? Last thing it can do this problem is with bad configured DNS servers on workstations and DC's.

  • Thanks. Yes time is in sync. Sorry what kind of profile do you mean?
    – jtheman
    Mar 11, 2015 at 22:46
  • 1
    I mean creating whole new user account, because it's general problem and there could be more causes why it doesn't work. So try to create for example new domain admin user account and log-in with this account to your machine. I don't know if you tried this. EDIT: I haven't noticed your message below, so my advice with NTLM helped, but it's just half-soulution because NTLM should work withous problems.
    – MyKE
    Mar 12, 2015 at 6:27
  • 1
    @jtheman I remember one last thing which could cause problems with NTLM, it can be caused by modified Group policy / Security policy settings of Network Security, e.g. 1drv.ms/1C9kQmw and set Network security: LAN Manager authentication level value to Send NTLMv2 response only on your Domain Controller Group Policy Managment.
    – MyKE
    Mar 12, 2015 at 7:01
  • OK, thanks, I checked the NTLMv2 response and it's not the case. Yes NTLM has been working before, So I agree it's just a half solution.
    – jtheman
    Mar 12, 2015 at 14:02

I have no clue why this apparently got changed - or other thing made this not to work. But unselecting the "network level authentication for remote-desktop services" for the server worked. Now everyone can access.

I used this simple guide: guide

Source: http://www.2x.com/disabling-network-level-authentication-for-remote-desktop-services-connections-2/


Thanks Sam, setting the security level in the RDP-Tcp settings to RDP Security Layer fixed it for us.

Turns out the better fix was to uninstall update KB3002657 from the domain controllers - that was the cause of the Netlogon problem for us.

Not the answer you're looking for? Browse other questions tagged or ask your own question.