2

I'm attempting to RDP into a Windows 10 Enterprise desktop behind a corporate firewall while using a proprietary cross-platform endpoint client installed on my home devices to access the network remotely through a DTLS SSL VPN tunnel.


This process succeeds on my Ubuntu 18.04 laptop using the Remmina client with the following settings:

Ubuntu18_Remmina_Settings


This process fails on my Windows 10 Pro desktop using the Remote Desktop Connection client with the following settings:

Win10_RDP_General Win10_RDP_Display Win10_RDP_LocalResources Win10_RDP_RemoteAudio Win10_RDP_LocalDevicesAndResources Win10_RDP_Experience Win10_RDP_Advanced Win10_RDP_GatewayServerSettings


I am able to access the network by VPN, but unfortunately when I attempt to connect I receive the following generic error message: Win10_RDP_TheLogonAttemptFailed


I have already attempted the following troubleshooting:

  • Verifying that the computer name, username, and password are identical to what I've used successfully on my Ubuntu machine.
  • Adding a private network firewall exception for Remote Desktop:

enter image description here

  • Setting the location type for the corporate network to private in my system's group policy settings:

enter image description here

  • Rebooting.

At this point I'd like to know how I can dig deeper into this and troubleshoot the RDP connection process. Here is the sort of information which I'm seeking:

  • Are there any obvious troubleshooting steps which I've missed?
  • Does the RDP client produce any log files? Where are they stored?
  • Is there an alternative Windows 10 RDP client which is known for being more reliable than the Microsoft one?

Updates:

  • I tried using Wireshark to filter traffic on the default RDP port (3389), but nothing was displayed. I verified that it's able to capture traffic on other ports (IE: HTTPS on 443) so it looks like the connection request is going out on some other port. I'm not sure how to find out which port it's using.
  • After some digging around I discovered that Windows stores outbound RDP connection events under ApplicationsAndServiceLogs/Microsoft/Windows/TerminalServices-ClientActiveXCore. Here's the reproducable error which I'm getting when attempting to connect:

Win10_Events_SSLError

Every result on Google for this error code indicates that it has something to do with RDP connections involving printers. I don't need a printer right now so I've tried unchecking printers under "Local Devices and Resources" in the RDP connection settings. Unfortunately, I'm still getting the same error code.


Resolved:

This is embarrassing, but it turns out that I wasn't entering the domain correctly. On my Linux system the Remmina client determined the domain automatically. On Windows, I had to enter it as [email protected].

1 Answer 1

3

Here are some additional troubleshooting steps:

  1. Capture the network traffic during a failed authentication to analyze the authentication mechanism in use and the server response.

  2. Review the security log from your RDP client, the RDP gateway, the RDP host, and the authenticating Domain Controller for related events (keep in mind auditing needs to be configured properly on each device)

  3. Use Fully Qualified Domain Names whenever possible to rule out any name resolution or Kerberos authentication dependencies.

Honestly though, when it comes to these cryptic logon failure messages, I always find the answer in the packet capture or the Domain Controller security log. But not everyone can access the DC logs or find their way around a network trace.

2
  • It seems simple enough, but your domain name tip turned out to be the key. My mistake was assuming I didn't need one since I was connecting fine from Linux without specifying the domain. Commented Dec 15, 2018 at 0:07
  • Glad to hear you got it figured out! Happy holidays!
    – twconnell
    Commented Dec 16, 2018 at 11:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .