Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →If Remote Desktop Connection says “An internal error has occurred,” start by testing the server locally, then work through the delay, encryption, certificate, key-permission, and protocol checks in that order. The message is generic: Microsoft documents it both before and after credentials are entered, and the text alone does not identify a single cause or prove that licensing is involved.
This guide follows a least-disruptive path. It distinguishes a network-path failure from a problem on the Windows host, uses temporary security changes only as controlled diagnostics, and shows what to collect if the server still will not accept RDP.
As an Amazon Associate I earn from qualifying purchases.
Use the symptom to choose the first branch
Note exactly when the connection fails and whether a second attempt behaves differently. Those observations determine which check is safest to try first.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
| What you observe | Most useful first branch | Why it matters |
|---|---|---|
| Localhost succeeds on the server, but a normal client connection fails | Investigate the network path, firewall, listener reachability, gateway, or name resolution. | The RDP service can accept a session locally, so the failure is probably between the client and the host. |
| Localhost fails too | Continue on the server with service, certificate, key, policy, and protocol checks. | The fault is present without the ordinary network route. |
| The first attempt pauses for up to about one minute, then the second succeeds | Temporarily test Windows Audio on the remote machine, and on the source machine if necessary. | Microsoft documents this delayed-first-attempt pattern as potentially related to Windows Audio settings. |
| Failure occurs before credentials appear | Prioritize reachability, listener, certificate, encryption negotiation, and TLS evidence. | Authentication has not started yet. |
| Failure occurs after credentials are entered | Include NLA, authentication, certificate/key access, policy, and server event logs in the investigation. | The connection progressed farther, so client reachability alone is not enough to explain it. |
| The host is an Azure virtual machine | Add Serial Console or offline OS-disk recovery checks. | Cloud recovery tools can repair a machine that cannot be reached over RDP. |
Microsoft has not published a prevalence statistic for this message, so treat the symptom as a starting point rather than evidence that one cause is common.
#1 Best Overall
- 【Easy to Connect & Use】The mini wireles keyboard remote is connected via USB receiver(included) and the work distance up to 10 meters. Just plug and play. very easy to connect and use. Powerful function (keyboard + touchpad + mouse) very perfect for browsing the web, playing games or watching TV.
- 【Widely Compatibility】The mini keyboard with touchpad can be used for Android TV box, smart TV, PC, Pad, Raspberry PI, PS3, x-box, desktop, laptop, smart phone,HTPC/IPTV, etc. If there is not a USB port, you need to prepare a OTG cable.
- 【Mutil-Colors Backlit and Rechargeable Battery】The USB mini keyboard has mutil-colors of backlit mode which can clear operate the keys when work at night, don't need to turn on the light which disturbing your families. With auto sleep and wake-up function, and comes with a rechargeable Li-ion battery, it can work for a long time.
- 【Portable Keyboard】 This small keyboard is designed Small and handheld design, has a innovative shape and petite size, takes up very minimal space in you bag and just makes you say goodbye to chunky keyboard to horizon a new experience of office entertainment anywhere, anytime.
- 【Sensitive Touchpad & Hotkeys】Wireless mini keyboard with multi-finger touchpad and combo with 8 hotkeys can easy and accurate manipulation. Easy to type and copy / paste, making it faster and more convenient for you browse the page.
1. Separate a network failure from a host failure
Use a web console, Hyper-V console, or another out-of-band method to sign in to the Windows server. This test avoids guessing about routers, VPNs, gateways, or firewall rules.
- Open a command prompt or PowerShell window on the server.
- Run
mstscto open Remote Desktop Connection. - In the Computer box, enter
localhostand connect. - Record whether the local connection succeeds, fails immediately, or shows the same message after credentials.
If localhost works, do not begin by changing certificates or security policy. Test the ordinary path from the client instead:
- Confirm the client resolves the intended server name and address.
- Check that the route, VPN, gateway, or firewall permits TCP 3389 (or the configured RDP port).
- Try the server’s address from a permitted administration network to distinguish name resolution from transport problems.
- Review gateway or load-balancer logs when the connection uses an RD Gateway or another intermediary.
If localhost fails, the network is not the first suspect. Leave the console open and proceed with the host-side checks below. A local test does not validate every external path, but it is a strong way to avoid making disruptive server changes for a client-side problem.
2. Check for the delayed first-attempt pattern
Microsoft notes that a first connection that waits up to roughly one minute and then succeeds on the second attempt can be associated with Windows Audio. This is a diagnostic branch, not a permanent recommendation for every server.
Test Windows Audio on the remote computer
- Open
services.mscon the remote computer. - Find Windows Audio.
- Stop the service and set its startup type to Disabled temporarily.
- From the client, make two fresh RDP attempts and record whether the long first-attempt delay disappears.
On a server where the audio service is required, schedule the test in a maintenance window. If disabling the remote service changes nothing, restore its original startup type before testing elsewhere.
Test the source computer only when needed
If the remote-side test does not explain the delay, repeat the same temporary test on the source computer. Restore both machines after the comparison. A successful second attempt is a clue about service initialization; it does not by itself prove that Windows Audio is the only fault.
3. Test encryption negotiation without leaving the server weakened
RDP must agree on authentication, security-layer, certificate, and encryption settings between the client and server. A policy mismatch can produce the same generic sentence as a certificate failure.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteRank #2
- 【Before Purchasing】The keyboard uses 2.4G connection technology.Please make sure your device has an available USB port to insert the receiver.If not, the keyboard is not suitable for your device
- 【Be sure to recharge the batteries for 1 hour before use】For the safety of transportation, the battery is nearly empty when you receive the device. When the battery is low, 2.4G cannot be paired or the connection is unstable
- 【Perfect combo】73 keys Wireless QWERTY keyboard + Touchpad,Key layout in line with the universal keyboard layout, fully functional, plug and play,White soft backlight design, use in the dark also unimpeded
- 【Multi-finger touchpad】a single finger click as left mouse function, two-finger click as the right mouse function, double finger drag as the rolling, bringing more convenience to your use
- 【Multifunctional mini wireless keyboard】3 in 1 Multifunction 2. 4GHz Mini Wireless QWERTY keyboard+ touchpad + LED Backlit(Fn+Win)
Back up the policy values first
On the server, open an elevated Command Prompt or PowerShell session and export the relevant policy key:
reg export "HKLMSOFTWAREPoliciesMicrosoftWindows NTTerminal Services" C:Temprdp-terminal-services.reg /yIf C:Temp does not exist, create it first. Then inspect the values Microsoft identifies:
reg query "HKLMSOFTWAREPoliciesMicrosoftWindows NTTerminal Services" /v UserAuthentication
reg query "HKLMSOFTWAREPoliciesMicrosoftWindows NTTerminal Services" /v SecurityLayerAlso check the equivalent settings in Group Policy. A domain policy can overwrite a local registry edit at the next refresh, making an apparently successful fix disappear.
Perform a controlled comparison
- Write down the current
UserAuthenticationandSecurityLayervalues and the policy that sets them. - In an isolated maintenance window, change one setting at a time to the temporary diagnostic value specified by your supported Microsoft procedure or organizational runbook.
- Apply policy, restart Remote Desktop Services if required, and make one controlled connection attempt.
- Immediately restore the original secure values if the test does not help, or after confirming the cause.
A successful connection after a controlled change points to encryption negotiation, certificate selection, or security policy. It does not justify leaving a weaker security layer or disabling required authentication. Do not use a temporary downgrade on an Internet-exposed production server as a permanent fix.
When restarting the service, warn connected users and use a maintenance window. An elevated PowerShell command is:
Restart-Service -Name TermService -ForceUse the command only when you understand its effect on existing sessions and have console access in case the service does not return.
4. Repair the RDP self-signed certificate path
When negotiation points to the server certificate, inspect the certificate that Remote Desktop Services is trying to use. A damaged, expired, or incorrectly recreated self-signed certificate can stop a direct connection before or after the credential prompt.
Rank #3
- 【Bluetooth & 2.4Ghz RF Connection】Support bluetooth 4.0, which makes the connection faster and more stable. Built-in Bluetooth (No Bluetooth Dongle) and a 2.4Ghz USB dongle, you can pair and connect Bluetooth devices and USB devices, operating distance can reach 33ft/10M.
- 【Touchpad and Hotkeys】Mini keyboard wireless with responsive touchpad supports multi-finger gestures for a precise control. Support rich hotkeys for quick control of many pages.
- 【Backlit Mini Keyboard】 Backlight keyboard allows you to operate the multimedia keyboard clearly in the dark.
- 【Rechargeable Handheld Keyboard Remote】 Built-in a rechargeable Li-ion battery. With the auto-sleep function, it can work for a long time.
- 【Widely Compatibility】Mini bluetooth keyboard & 2.4Ghz wireless keyboard for Amazon Fire TV Stick 4K/ Lite/Cube, Android TV Box, Smart TV, Raspberry pi, Xbox 360, PS3, HTPC, IPTV, Pad, PC
Inspect the Remote Desktop certificate store
- On the server, run
mmc.exe. - Select File > Add/Remove Snap-in.
- Add Certificates, choose Computer account, then choose Local computer.
- In the console tree, open the computer-account Remote Desktop certificate store.
- Inspect the certificate used by RDP: subject, expiration, private-key availability, and thumbprint.
Do not delete a certificate merely because it is self-signed. First confirm that it is the affected RDP certificate and export or otherwise document any certificate that must be retained.
Recreate an affected self-signed certificate
- Back up the certificate and record its thumbprint and current RDP configuration.
- Delete only the affected self-signed certificate from the Remote Desktop store.
- Restart Remote Desktop Services (the
TermServiceservice). - Reopen the store and verify whether Windows recreated a valid certificate.
- Test RDP locally with
mstscandlocalhost, then test from the normal client path.
If the certificate is not recreated, check these services and their event records:
- Certificate Propagation (
CertPropSvc) - CNG Key Isolation (
KeyIso) - Cryptographic Services (
CryptSvc) - Remote Desktop Configuration (
SessionEnv)
Use services.msc or PowerShell to verify that each service can start. In Event Viewer, review Windows Logs > System and the Service Control Manager events at the time of the failed recreation. A service that cannot start is a more actionable fault than the generic RDP dialog.
5. Check the private-key permissions in MachineKeys
RDP needs to open the private key associated with its certificate. If the key exists but the service account cannot read it, certificate recreation or TLS negotiation can fail.
Identify the RDP key carefully
The machine-key directory is:
C:ProgramDataMicrosoftCryptoRSAMachineKeysMicrosoft identifies the RDP machine-key filename prefix as:
Recommended Free Tools
f686aace6942fb7f7ceb231212eef4a4Use the prefix to locate the likely key, but do not assume every file with a similar name belongs to the current certificate. Confirm the certificate and key relationship before changing anything.
Back up before correcting access
- Record the affected certificate thumbprint, key filename, owner, and current access-control entries.
- Back up the certificate and preserve the existing ACL information.
- Compare the key’s ownership and permissions with a known-good Windows installation or Microsoft’s documented MachineKeys requirements.
- Correct only the affected key or the specific MachineKeys permissions that are demonstrably wrong.
- Restart
TermServiceand verify certificate recreation or successful RDP negotiation.
Do not take ownership of the entire MachineKeys folder or grant broad write access as a shortcut. The folder contains keys used by other Windows services; an indiscriminate ACL change can create new security and cryptographic failures. If the permissions are unclear, preserve the evidence and escalate rather than deleting unrelated keys.
Rank #4
- Easy Setup: Simply insert the nano USB receiver into your computer and use the keyboard instantly. Arteck 2.4G Wireless Keyboard Stainless Steel Ultra Slim Full Size Keyboard with Numeric Keypad for Computer/Desktop/PC/Laptop/Surface/Smart TV and Windows 10/8/ 7 Built in Rechargeable Battery
- Ergonomic design: Stainless steel material gives heavy duty feeling, low-profile keys offer quiet and comfortable typing.
- 6-Month Battery Life: Rechargeable lithium battery with an industry-high capacity lasts for 6 months with single charge (based on 2 hours non-stop use per day).
- Ultra Thin and Light: Compact size (16.9 X 4.9 X 0.6in) and light weight (14.9oz) but provides full size keys, arrow keys, number pad, shortcuts for comfortable typing.
- Package contents: Arteck Stainless 2.4G Wireless Keyboard, nano USB receiver, USB charging cable, welcome guide, our 24-month warranty and friendly customer service.
6. Verify the RDP protocol and cipher configuration
When the certificate exists and the key is accessible, inspect the values that control protocol negotiation. Check both local configuration and domain policy so that you know which setting will persist.
Confirm the certificate thumbprint binding
Unless the server has the Connection Broker role, verify SSLCertificateSHA1HashValue against the thumbprint of the certificate you intend RDP to use. The value is associated with the RDP-Tcp listener under:
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsHKLMSYSTEMCurrentControlSetControlTerminal ServerWinStationsRDP-TcpAn incorrect or stale thumbprint can point the listener at a certificate whose private key is missing or inaccessible. Do not apply this check in the same way to a server with the Connection Broker role; its certificate handling is different.
Check security-protocol negotiation
Microsoft calls out these policy values:
fAllowSecProtocolNegotiationshould be set to1so the server can negotiate the supported security protocol.MinEncryptionLevelshould be set to3.
Inspect them under the Terminal Services policy area and confirm that Group Policy does not replace them:
reg query "HKLMSOFTWAREPoliciesMicrosoftWindows NTTerminal Services" /v fAllowSecProtocolNegotiation
reg query "HKLMSOFTWAREPoliciesMicrosoftWindows NTTerminal Services" /v MinEncryptionLevelIf the values are managed elsewhere, correct the policy source, run gpupdate /force during a maintenance window, and restart the RDP service if the policy requires it.
Review cipher-suite and SCHANNEL policy
A cipher suite removed from the server, disabled TLS version, or incompatible SSL policy can prevent the client and server from finding a common protocol. Review:
- Computer Configuration > Administrative Templates > Network > SSL Configuration Settings > SSL Cipher Suite Order
- SCHANNEL events in Event Viewer > Windows Logs > System
- Any organization-specific SSL or cryptography policy that disables protocols or suites required by the RDP client
Change one policy at a time, record the before-and-after state, and retest from the console and from a client. Avoid enabling obsolete protocols simply to make a connection succeed; use the evidence to identify the incompatible endpoint or policy instead.
Best Value
- Compact and Portable QWERTY Keyboard with Touchpad: Innovative and compact QWERTY keyboard with touchpad that provides comfort combined with the freedom of wireless connectivity. Connect to all of your favorite devices with this wireless keyboard. This controller gives you everything you need right in the palm of your hand. Navigate the cursor easily with your thumb without having to touch your screen, mouse or keyboard
- 2.4ghz and 5.2 Bluetooth Compatibility: This keyboard connects to a multitude of devices through 5.2 Bluetooth and a 2.4ghz nano USB dongle such as for: Apple TV, Amazon Fire Stick, Google TV, Playstation PS4/PS4 Pro/PS5, HTPC/IPTV, VR Glasses (Virtual Reality Headset Box) smartphones (iOS/Android/Windows), notebooks, laptops (Windows/Mac OS X v10.7 Lion and above) and more. With a working range of approx. 33ft/10m, easily connect and control Bluetooth devices with this wireless keyboard. (Not Compatible with Xbox series).
- Long-Lasting Rechargeable Battery: Built-in rechargeable lithium-ion battery with up to 10 days of continuous working time and up to 50 days of standby time. The LED indicators notify when the battery is low and when it is fully charged. Charging via the included USB-C cable is simple and easy
- Backlit Keyboard: The convenient backlit keyboard is perfect for using in a dark environment
- Limited Lifetime Warranty: We cannot guarantee compatibility with all smart T.V.s. Please check the Bluetooth capability of your T.V. before purchase
7. Add cloud recovery checks for Azure virtual machines
An Azure VM can require a recovery path that does not depend on RDP. Microsoft lists unsecured RDP exposure, inaccessible local RSA keys, disabled TLS, and corrupted or expired certificates among possible causes.
Use a console or offline disk repair
- Use Azure Serial Console when it is enabled and the VM’s configuration permits it.
- If the VM cannot boot or the console is unavailable, stop it, attach its OS disk to a repair VM, and work on the disk offline according to your change-control process.
- Repair the certificate, MachineKeys permissions, TLS settings, or RDP policy identified by the evidence.
- Detach the disk, reattach it to the original VM, start the VM, and test through the console before exposing RDP to the normal network path.
Verify the Azure-specific basics
- Confirm that
TermServiceowns and listens on port 3389, unless the VM intentionally uses another RDP port. - Inspect TLS and Network Level Authentication settings for an accidental disablement or incompatible policy.
- Check the RDP certificate for expiration, corruption, and a usable private key.
- Correct MachineKeys access only when the key and its permissions are identified as the fault.
- Review network security rules so that RDP is not broadly exposed to the Internet.
Do not treat a successful Serial Console login as proof that the external network path is healthy; repeat the local and remote tests after the repair.
8. Collect diagnostic evidence before escalating
If the ordered checks do not resolve the error, collect client and server evidence during a reproducible failure. Microsoft’s TroubleShootingScript (TSS) guidance identifies separate RDP scenarios:
Free tools Windows power users keep installed
One-click scans. No signup required.
UEX_RDSclion the clientUEX_RDSsrvon the server
For an authentication-related failure, Microsoft specifies collecting with:
-UEX_Auth -UEX_Logon -UEX_RDSProfiles -UEX_RDSScard -Mode Basic- Prepare the collection on both machines before reproducing the problem.
- Record the exact time, source computer, destination name or address, whether the failure occurred before or after credentials, and whether the first attempt was delayed.
- Reproduce the failure once or twice, rather than generating hours of unrelated logs.
- Collect the client and server packages and preserve the event-log timestamps.
- Include the certificate thumbprint, relevant registry exports, service states, and any SCHANNEL or Service Control Manager event IDs.
Keep credentials and private keys out of the case bundle. Redact secrets while retaining the timestamps and configuration values needed to correlate the failure.
9. Consider licensing only when evidence points there
The RDP protocol specification defines ERRINFO_LICENSE_INTERNAL (0x00000100) as an internal error in the Terminal Services licensing component. That is a specific protocol indication, not a synonym for every dialog that says “An internal error has occurred.”
Check licensing when protocol traces, server events, or the RDS licensing configuration identify it as the failing component. Do not replace certificates, weaken encryption, or rebuild a licensing configuration solely because the user-facing sentence contains the word “internal.”
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →10. When to stop self-service troubleshooting
Escalate after you have tested the local path, delayed-attempt behavior, encryption negotiation, certificate recreation, MachineKeys access, protocol and cipher policy, and—when applicable—Azure recovery. Provide the evidence package rather than only the screenshot of the dialog.
Microsoft directs administrators to contact Microsoft Support when the documented checks cannot resolve the issue. A support engineer can correlate the TSS traces, SCHANNEL events, certificate state, and RDP listener configuration without requiring you to keep weakening security settings in production.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
