The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Repair a failed Windows Remote Desktop (RDP) connection in layers: verify the computer name and network path, confirm Remote Desktop is enabled, check the two RDP services, test the listener and port, repair Windows and intervening firewall rules, then resolve Network Level Authentication (NLA) and logon-rights issues. This order prevents you from changing security settings when the real problem is DNS, a stopped service, or a blocked port.
The default RDP port is TCP 3389. The core services are Remote Desktop Services (TermService) and Remote Desktop Services UserMode Port Redirector (UmRdpService). NLA should remain enabled in normal environments; disable it only as a controlled compatibility test and restore it after the underlying problem is fixed.
As an Amazon Associate I earn from qualifying purchases.
Use a layered diagnosis instead of changing settings at random
An RDP failure can occur before Windows authentication, while the session is being created, or after credentials are checked. Treat each layer as a separate question:
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →- Target and network: Is the client reaching the intended computer, and is that computer powered on and awake?
- RDP enablement and policy: Is the host configured to accept Remote Desktop connections?
- Services: Are TermService and UmRdpService running?
- Listener and port: Is an RDP listener bound to the expected port, normally TCP 3389?
- Firewalls: Do Windows Firewall, network firewalls, and cloud security groups allow the connection?
- Authentication and authorization: Can the client perform NLA, and is the account allowed to log on through Remote Desktop Services?
Record the result of each test. A successful TCP test proves reachability to a port, not that the account is authorized; a credential error does not prove the firewall is correctly configured.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Before you change anything
- Keep a local, console, or out-of-band administrator session available. Disabling a firewall or changing RDP policy remotely can lock you out.
- Note the computer name, IP address, current RDP port, network profile, and whether the host is domain-joined.
- Make one change at a time and retest from the same client. Record the original value so you can roll it back.
- Use the least privilege needed. A standard user can run connectivity tests; service, firewall, registry, and policy changes normally require local administrator rights, while domain Group Policy changes require the appropriate domain administration role.
1. Confirm the target and network path
Check power, sleep, and the intended name
Verify that the remote computer is powered on, not asleep, and connected to the expected network. Confirm the spelling of the computer name. If the user normally connects through an alias, test the host’s actual name or address to exclude a stale alias.
Separate name-resolution failures from RDP failures
From the client, first test the name and then the IP address. If the IP works but the name fails, repair DNS, the hosts file, or the name-resolution path rather than changing RDP settings. If neither works, continue with routing and firewall checks.
ping computer-name
ping 192.0.2.25Ping may be blocked even when RDP is available, so treat a failed ping as inconclusive. The decisive test is the RDP port:
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchTest-NetConnection -ComputerName computer-name -Port 3389
Test-NetConnection -ComputerName 192.0.2.25 -Port 3389Look at TcpTestSucceeded. True means the client completed a TCP connection to that address and port. False points to a wrong address, routing problem, stopped listener, or firewall block; it does not identify which one.
Check intervening network controls
On a corporate or hosted network, traffic can cross a local firewall, a perimeter firewall, a router ACL, a VPN policy, or a cloud network security group. Check each control for the source network, destination address, destination port, and protocol. A Windows rule can be correct while an upstream device still drops the packet.
2. Confirm that Remote Desktop is enabled and permitted
Use the Windows settings interface
- On a supported Windows client, open Settings > System > Remote Desktop.
- Turn on Remote Desktop and confirm the computer name shown for connections.
- Leave Require devices to use Network Level Authentication to connect (recommended) enabled unless you are performing a temporary compatibility test.
- Open the list of users who can remotely access the PC and add the required account if it is not already an administrator.
Windows Server can be configured through its server management and system tools. On either platform, a local or domain policy can override a setting shown in the graphical interface, so a control that appears enabled is not proof that policy permits connections.
Check the account before testing credentials
Confirm that the account is not disabled, locked out, expired, or required to change its password at the next sign-in. For a local account, use the account’s actual password rather than a PIN or other local sign-in method. For a domain account, test with the correct domain-qualified form, such as CONTOSOj.smith or [email protected], according to your organization’s identity configuration.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
3. Check the two Remote Desktop services
Inspect service state
Remote Desktop depends primarily on these services:
| Display name | Service name | Role |
|---|---|---|
| Remote Desktop Services | TermService |
Hosts the Remote Desktop session service and listener. |
| Remote Desktop Services UserMode Port Redirector | UmRdpService |
Supports user-mode redirection components used by RDP sessions. |
Open services.msc, locate both entries, and check that their status is Running. From an elevated PowerShell window, you can inspect them directly:
Get-Service -Name TermService,UmRdpServiceIf a service is stopped, start it and retest:
Start-Service -Name TermService
Start-Service -Name UmRdpServiceA restart can disconnect every active RDP session. Schedule it if the computer is serving other users.
If a service will not start
- Read the error shown by
Start-Serviceand inspect Event Viewer > Windows Logs > System and Applications and Services Logs > Microsoft > Windows > TerminalServices. - Check whether security software, hardening policy, or a service-dependency failure changed the startup configuration.
- Do not replace service binaries or copy registry settings from another computer. Correct the policy or dependency that caused the failure.
4. Check Remote Desktop policy and registry state
When the interface and service state look correct but the host still refuses connections, inspect policy. On a domain-joined computer, domain Group Policy can reapply a value after a local change.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Review the connection-denial policy
Use the Local Group Policy Editor where available and review the Remote Desktop Services policies under Computer Configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host. Pay particular attention to policies that allow or deny connections, require NLA, limit users, or specify a listener configuration.
To see the effective result, generate a policy report:
gpresult /h C:WindowsTempgpresult.htmlOpen the report locally and identify the winning domain or local policy. A local setting is not authoritative when a higher-precedence policy configures a different value.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Inspect the key enablement values
When troubleshooting a policy or registry-based configuration, verify that fEnableWinStation is 1 and fDenyTSConnections is 0 in the applicable default and policy locations. The commonly inspected default location is:
HKLMSYSTEMCurrentControlSetControlTerminal ServerPolicy-controlled values may appear under:
HKLMSOFTWAREPoliciesMicrosoftWindows NTTerminal ServicesDo not blindly create or delete values. Export the relevant key before editing, change only the value required by the approved policy, and run gpupdate /force when a policy correction is intended. If the domain policy is the source, fix the policy rather than repeatedly editing the local registry.
5. Verify the listener and RDP port
Test the default listener
Microsoft identifies TCP 3389 as the default RDP port. From the client, run Test-NetConnection against that port. On the host, inspect listening sockets:
Get-NetTCPConnection -State Listen -LocalPort 3389
netstat -ano | findstr :3389A listening socket should be associated with the RDP service. If another process owns the port, identify its process ID and correct the conflict rather than simply opening a second firewall rule.
When the port was changed
Some organizations use a non-default port, but changing the port is not a substitute for a firewall or authentication fix. Confirm the configured listener value, restart the relevant service during a maintenance window, and create matching TCP and UDP inbound rules. Connect with host-and-port syntax:
Free tools Windows power users keep installed
One-click scans. No signup required.
mstsc /v:computer-name:3390Replace 3390 with the approved port. A client that omits the port will still try 3389, so document the change for every support team and connection profile.
6. Repair Windows Firewall rules
Enable the built-in Remote Desktop rules
Open wf.msc and inspect inbound rules in the Remote Desktop display group. The usual rules are Remote Desktop – User Mode (TCP-In) and Remote Desktop – User Mode (UDP-In). Enable the rules only for the network profiles and source ranges that need access.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
The documented PowerShell method is:
Get-NetFirewallRule -DisplayGroup "Remote Desktop" | Set-NetFirewallRule -Enabled TrueThat command enables every rule in the display group. In a hardened environment, inspect the resulting scope and profile settings and narrow them if necessary. To review the rules first:
Get-NetFirewallRule -DisplayGroup "Remote Desktop" | Format-Table DisplayName,Enabled,Profile,Direction,ActionCheck profiles and rule scope
A rule enabled only for the Domain profile will not necessarily permit a connection when Windows identifies the interface as Private or Public. Confirm the active profile with:
Get-NetConnectionProfilePrefer a narrowly scoped allow rule for the required source subnet. Avoid leaving RDP open on a Public profile unless that exposure is explicitly designed and monitored.
Check firewalls outside Windows
Review every device between client and host, including VPN concentrators, perimeter firewalls, router ACLs, and cloud network security groups. Confirm both the destination address and the actual RDP port. During a controlled maintenance test, temporarily disabling one firewall can isolate the responsible layer, but the permanent repair is a correctly scoped allow rule, not an unattended firewall shutdown.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.7. Resolve Network Level Authentication failures
What NLA changes
NLA authenticates the user before Windows creates a full remote session. That reduces exposure of the session host and is the normal choice for supported clients. Microsoft describes it this way: “Network Level Authentication (NLA) adds an extra layer of security to Remote Desktop connections.”
An NLA error can result from an old client that cannot perform the required authentication protocol, a domain-trust or credential problem, a clock or certificate issue in the authentication path, or a user-rights restriction. First prove that the host is reachable and listening; do not treat every credential prompt as an NLA problem.
Recommended Free Tools
Use a temporary NLA exception only to isolate compatibility
- On the host, open Settings > System > Remote Desktop.
- Temporarily clear Require devices to use Network Level Authentication to connect (recommended), or apply the equivalent approved policy change.
- Test from the affected client while monitoring the result.
- Re-enable NLA immediately after the test unless a documented exception is required and risk-assessed.
If disabling NLA changes the result, update or replace the incompatible client, correct the authentication path, or remediate the account and policy issue. Leaving NLA disabled broadens the pre-authentication attack surface and should not be the default fix.
8. Check logon rights and Group Policy precedence
Membership is necessary but not always sufficient
The account normally needs membership in the local Remote Desktop Users group or local Administrators, subject to the organization’s policy. Check membership on the host:
Get-LocalGroupMember -Group "Remote Desktop Users"For domain groups, verify that the expected group is actually nested or assigned on the computer. A user can be a member of an allowed group and still be denied by a higher-precedence policy.
Inspect user-rights assignments
In the Local Security Policy or an applied domain policy, check:
- Allow log on through Remote Desktop Services includes the required user or group.
- Deny log on through Remote Desktop Services does not include that user, a nested group, or a broad group containing the user.
- Any policy restricting concurrent sessions, time windows, or remote logon types permits the connection.
An explicit deny generally takes precedence over an allow. Use gpresult or the Resultant Set of Policy report to find which policy supplied each right. Correct the winning policy and allow time for replication when the change is made in a domain.
9. Use logs to distinguish service, network, and authentication faults
On the host, inspect Event Viewer > Applications and Services Logs > Microsoft > Windows > TerminalServices-LocalSessionManager and TerminalServices-RemoteConnectionManager. These logs can show whether a connection reached the session host, whether a listener rejected it, and whether authentication or authorization failed. Correlate event times with firewall logs and the client-side error.
On the client, review the Remote Desktop client event logs and note the exact error text. “The remote computer cannot be reached” calls for network, listener, or firewall testing; “the requested session access is denied” calls for account rights and policy; an NLA or credential error calls for authentication compatibility and identity checks.
10. Secure access from outside the local network
Do not solve an external-access problem by exposing an unprotected RDP endpoint directly to the internet. Use a VPN or an RD Gateway design that places an authenticated gateway in front of internal desktops and applies centralized policy.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minute“End users can connect to internal network resources securely from outside the corporate firewall through RD Gateway.” — Microsoft, Remote Desktop Services – Access from anywhere.
For a VPN, restrict which networks and hosts are reachable after connection and require strong authentication. For RD Gateway, publish the gateway rather than each internal desktop, use a valid certificate and authentication policy, and keep the internal RDP listener restricted to the gateway or approved management networks. Monitor gateway, VPN, and Windows logs and remove temporary internet-facing rules after testing.
Choose the least risky repair for the fault you found
| Fault layer | Typical symptom | First action | Usual privilege | Security and reversibility |
|---|---|---|---|---|
| Target or DNS | Name fails; IP test may work | Test the name and IP separately; correct DNS or routing | User for tests; network administrator for infrastructure | Low security impact; easy to reverse |
| Service | Port is closed and TermService or UmRdpService is stopped | Start the affected service and inspect events | Local administrator | Usually reversible; can disconnect active sessions |
| Listener or port | No listener on 3389, or a different port is documented | Resolve the port conflict or use the configured host:port | Local administrator | Port changes affect clients and firewall rules |
| Windows firewall | Listener exists but TCP test fails | Enable and scope Remote Desktop TCP/UDP rules | Local administrator | Reversible; keep scope and profile narrow |
| Network or cloud firewall | Host rules are correct but packets never arrive | Permit the source, destination, and port in the intervening control | Network or cloud administrator | Exposure depends on scope; remove temporary broad rules |
| NLA or rights | Connection reaches host but authentication is rejected | Check client compatibility, group membership, user rights, and policy precedence | Local or domain administrator | Keep NLA enabled; disabling it is a temporary, higher-risk exception |
| Internet exposure | Internal RDP works but external access is required | Deploy VPN or RD Gateway rather than direct port forwarding | Network and identity administrators | Most secure architecture; requires design and monitoring |
Complete verification and rollback checklist
- Connect by the intended computer name and confirm it resolves to the correct address.
- Run
Test-NetConnectionto the configured RDP port from an approved client. - Confirm both TermService and UmRdpService are running.
- Verify the listener is bound to the expected TCP port and that no unrelated process owns it.
- Confirm the Remote Desktop TCP-In and UDP-In rules are enabled for the correct profile and source scope.
- Check upstream firewalls, VPN policy, and cloud network security groups.
- Confirm Remote Desktop is enabled, the account is allowed, and no deny right or overriding policy blocks it.
- Test NLA with the normal supported client. If NLA was disabled for diagnosis, restore it and retest.
- Remove temporary firewall exceptions, alternate ports, registry edits, and internet-facing rules that are no longer required.
- Document the final port, policy owner, permitted source networks, and the successful test result.
If the connection still fails, return to the first layer whose test is unsuccessful. Do not escalate a network problem into a registry change or leave NLA disabled merely because it made one legacy client connect.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
