How to learn more when the Windows 10 RDP client displays a "logon failed" message?

Question

I'm attempting to RDP into a Windows 10 Enterprise desktop behind a corporate firewall while using a proprietary cross-platform endpoint client installed on my home devices to access the network remotely through a DTLS SSL VPN tunnel.

---

This process succeeds on my Ubuntu 18.04 laptop using the Remmina client with the following settings:

---

This process fails on my Windows 10 Pro desktop using the Remote Desktop Connection client with the following settings:

---

I am able to access the network by VPN, but unfortunately when I attempt to connect I receive the following generic error message:

---

I have already attempted the following troubleshooting:

• Verifying that the computer name, username, and password are identical to what I've used successfully on my Ubuntu machine.
• Adding a private network firewall exception for Remote Desktop:

• Setting the location type for the corporate network to private in my system's group policy settings:

• Rebooting.

---

At this point I'd like to know how I can dig deeper into this and troubleshoot the RDP connection process. Here is the sort of information which I'm seeking:

• Are there any obvious troubleshooting steps which I've missed?
• Does the RDP client produce any log files? Where are they stored?
• Is there an alternative Windows 10 RDP client which is known for being more reliable than the Microsoft one?

---

Updates:

• I tried using Wireshark to filter traffic on the default RDP port (3389), but nothing was displayed. I verified that it's able to capture traffic on other ports (IE: HTTPS on 443) so it looks like the connection request is going out on some other port. I'm not sure how to find out which port it's using.
• After some digging around I discovered that Windows stores outbound RDP connection events under ApplicationsAndServiceLogs/Microsoft/Windows/TerminalServices-ClientActiveXCore. Here's the reproducable error which I'm getting when attempting to connect:

Every result on Google for this error code indicates that it has something to do with RDP connections involving printers. I don't need a printer right now so I've tried unchecking printers under "Local Devices and Resources" in the RDP connection settings. Unfortunately, I'm still getting the same error code.

---

Resolved:

This is embarrassing, but it turns out that I wasn't entering the domain correctly. On my Linux system the Remmina client determined the domain automatically. On Windows, I had to enter it as username@domain.com.

Answer 1

Here are some additional troubleshooting steps:

1. Capture the network traffic during a failed authentication to analyze the authentication mechanism in use and the server response.

2. Review the security log from your RDP client, the RDP gateway, the RDP host, and the authenticating Domain Controller for related events (keep in mind auditing needs to be configured properly on each device)

3. Use Fully Qualified Domain Names whenever possible to rule out any name resolution or Kerberos authentication dependencies.

Honestly though, when it comes to these cryptic logon failure messages, I always find the answer in the packet capture or the Domain Controller security log. But not everyone can access the DC logs or find their way around a network trace.