How to Fix Windows RDP Internal Error (Server 2016-2025)

The Windows RDP internal error usually means the Remote Desktop service, listener, or client session state needs to be refreshed—not that you need to reinstall Windows. This guide takes about ten minutes and gives you a working recovery path for Windows Server 2016, 2019, 2022, and 2025.

Prerequisites

• Windows Server 2016, 2019, 2022, or 2025 with Desktop Experience or Server Core.
• A local administrator account, an existing administrator session, or console access. If RDP is unavailable, open the VPSLake client area at https://my.vpslake.com, launch the VPS control panel (Virtualizor), and use VNC Console.
• The server’s public IP address or DNS name, plus a second computer for testing the connection.
• No special RAM or disk allocation is needed; keep a VPS snapshot or backup available before changing remote-access settings.
• If you need a Windows server for this procedure, VPSLake Windows RDP hosting includes administrator access for remote management.

Step 1: Confirm whether the problem is the network or the RDP session

Testing the port first prevents you from changing Windows settings when the connection is actually blocked upstream.

From another Windows computer, open Windows PowerShell and run this command. Replace SERVER_IP with the VPS public IP or DNS name:

Test-NetConnection -ComputerName SERVER_IP -Port 3389

Expected output includes:

ComputerName     : SERVER_IP
RemotePort       : 3389
TcpTestSucceeded : True

True means the endpoint is reachable, but it does not prove that the RDP service is healthy. If it is False, keep the VPS control panel’s VNC Console open and continue; you will check the server-side firewall and listener in Step 4.

Step 2: Restart the Remote Desktop services

A stuck TermService process can leave the RDP listener in a bad state while Windows itself continues running, so restart the service from a console or a separate administrator session.

Open Windows PowerShell → Run as administrator on the server and check both services:

Get-Service -Name TermService,UmRdpService | Select-Object Name,DisplayName,Status,StartType

The normal state is Running for both services. Restart the main service; Windows will also prompt to restart the Remote Desktop Services UserMode Port Redirector when that dependency is active:

Restart-Service -Name TermService -Force
Get-Service -Name TermService,UmRdpService | Select-Object Name,Status

Expected output:

Name          Status
----          ------
TermService   Running
UmRdpService  Running

A service restart can terminate active RDP sessions, so do not run it from the only session you need for recovery unless the VPS console is ready. The same operation is available at Server Manager → Tools → Services → Remote Desktop Services → Restart. Microsoft’s RDP general troubleshooting guide documents these services and the listener checks.

Step 3: Re-enable Remote Desktop without weakening NLA

The error can follow an interrupted or inconsistent Remote Desktop setting; restore the allow-connection value and leave Network Level Authentication enabled.

In an elevated PowerShell window on the server, run:

$TerminalServer = 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server'
Set-ItemProperty -Path $TerminalServer -Name fDenyTSConnections -Value 0
Enable-NetFirewallRule -DisplayGroup 'Remote Desktop'
Get-ItemProperty -Path $TerminalServer -Name fDenyTSConnections

Expected output is:

fDenyTSConnections
------------------
                 0

The registry value 0 allows incoming RDP connections, and the firewall command enables Windows’ built-in Remote Desktop rules. This does not turn off NLA, which should remain active for an internet-facing server.

For the graphical route, open Server Manager → Local Server → Remote Desktop, select Allow remote connections to this computer, keep Allow connections only from computers running Remote Desktop with Network Level Authentication (recommended) selected, and choose Apply → OK. If a domain Group Policy manages this setting, change the policy at Group Policy Management → Computer Configuration → Administrative Templates → Windows Components → Remote Desktop Services → Remote Desktop Session Host → Connections instead of repeatedly changing the local value. See Microsoft’s Remote Desktop access guidance for the supported setting.

Step 4: Check the listener and Windows Firewall

RDP is repaired only when TermService is running, a process is listening on the expected port, and an enabled inbound rule permits the traffic.

Run these checks on the server:

Get-NetTCPConnection -LocalPort 3389 -State Listen | Select-Object LocalAddress,LocalPort,State,OwningProcess
Get-NetFirewallRule -DisplayGroup 'Remote Desktop' | Where-Object Enabled -eq $true | Select-Object DisplayName,Profile,Direction,Action
Get-Service -Name TermService | Select-Object Name,Status,StartType

Expected output contains a listener and an enabled allow rule:

LocalAddress LocalPort State  OwningProcess
------------ --------- -----  -------------
0.0.0.0      3389      Listen 1234

Name        Status  StartType
----        ------  ---------
TermService Running Automatic

If your server uses a custom RDP port, replace 3389 in the listener and client tests with that port. Also allow the same port in any provider-side firewall or security group; Windows Defender Firewall cannot override a block outside the guest.

Step 5: Clear stale credentials on the client

When the server is reachable and healthy but only one computer shows the internal error, remove that computer’s saved RDP credential and default connection profile.

Close every Remote Desktop Connection window on the client. Open Control Panel → Credential Manager → Windows Credentials, remove entries beginning with TERMSRV/ for this server, and select Remove. You can list saved entries from PowerShell as well:

cmdkey /list
cmdkey /delete:TERMSRV/SERVER_IP

Replace SERVER_IP with the address stored in the credential. If you normally connect by hostname, remove the matching TERMSRV/SERVER_NAME entry too. To reset the client’s default profile without deleting it, open PowerShell and run:

Rename-Item "$env:USERPROFILE\Documents\Default.rdp" "Default.rdp.old" -ErrorAction SilentlyContinue

Start a fresh client session:

mstsc.exe /v:SERVER_IP

Enter the username in the correct form, such as SERVER_NAME\ADMIN_USERNAME for a local account or DOMAIN\USERNAME for a domain account. Do not paste a password into a command or save credentials on a shared computer.

Verify the repaired connection

First confirm the server-side state, then connect from a different computer so the test does not reuse the broken client session:

Get-Service -Name TermService | Select-Object Status
Get-NetTCPConnection -LocalPort 3389 -State Listen | Select-Object LocalPort,State
Test-NetConnection -ComputerName SERVER_IP -Port 3389
mstsc.exe /v:SERVER_IP

The first two checks should show Running and Listen, and the network test should report TcpTestSucceeded : True. The Remote Desktop client should then reach the sign-in screen and accept a permitted administrator or Remote Desktop Users account.

Troubleshooting

“An internal error has occurred” returns immediately

The client may be reusing a damaged saved credential or RDP profile, or TermService may still have a stale listener. Repeat Step 2 from VNC Console, complete Step 5 on the affected client, and reconnect with mstsc.exe /v:SERVER_IP.

TcpTestSucceeded : False

The server is not reachable on the tested port. From the console, confirm the listener and enabled Remote Desktop firewall rules from Step 4, then check the VPS control panel’s network firewall or security-group rules. If the listener is on a nonstandard port, test that port rather than 3389.

Get-NetTCPConnection returns no listener

Remote Desktop Services may have failed to start, or a policy may still deny connections. Run Get-Service TermService, check fDenyTSConnections is 0, restart TermService, and inspect Event Viewer → Applications and Services Logs → Microsoft → Windows → TerminalServices-LocalSessionManager → Operational for the first error at the failure time.

The connection reaches sign-in but rejects the account

This is an authentication or permission issue, not the original transport error. Confirm the username prefix, verify the account is enabled and not locked, and add a non-administrator account through Server Manager → Tools → Computer Management → Local Users and Groups → Groups → Remote Desktop Users. Keep NLA enabled and correct the account or policy instead of disabling it.

Hardening

• Restrict the Windows Firewall Remote Desktop rules to trusted administrator IP addresses or a VPN when your network design permits it.
• Keep NLA, Windows updates, strong unique passwords, and account lockout monitoring enabled.
• Leave the VPS control panel’s console available for recovery before changing the RDP port, firewall policy, or administrator account.
• Record the working RDP port and keep a second administrator or approved recovery method so one bad credential cannot lock you out.

FAQ

Does restarting Remote Desktop Services reboot the server?

No. It restarts the RDP service and can disconnect active Remote Desktop sessions, but it does not restart Windows. Use the VPS console or a separate administrator session before restarting it.

Should I disable Network Level Authentication to fix this error?

No. NLA requires authentication before Windows creates a full remote session and should stay enabled on an internet-facing server. Repair the service, listener, firewall, credentials, or account policy instead.

Why does RDP work from one computer but not another?

The server is probably reachable and the problem is local to the failing client, commonly a stale TERMSRV credential or corrupted Default.rdp profile. Remove only the saved entry for this server, rename the profile, and create a fresh connection.

Can I fix this without an RDP session?

Yes. Use the VPSLake client area to open the VPS control panel (Virtualizor), then choose VNC Console. From that local console, run the elevated PowerShell checks and service restart in this guide.