{"id":827,"date":"2026-10-13T13:00:00","date_gmt":"2026-10-13T13:00:00","guid":{"rendered":"https:\/\/vpslake.com\/blog\/?p=827"},"modified":"2026-10-13T13:00:00","modified_gmt":"2026-10-13T13:00:00","slug":"fix-windows-rdp-internal-error","status":"publish","type":"post","link":"https:\/\/vpslake.com\/blog\/2026\/10\/13\/fix-windows-rdp-internal-error\/","title":{"rendered":"How to Fix Windows RDP Internal Error (Server 2016-2025)"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">The Windows RDP internal error usually means the Remote Desktop service, listener, or client session state needs to be refreshed\u2014not that you need to reinstall Windows. This guide takes about ten minutes and gives you a working recovery path for Windows Server 2016, 2019, 2022, and 2025.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Prerequisites<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li>Windows Server 2016, 2019, 2022, or 2025 with Desktop Experience or Server Core.<\/li>\n\n\n<li>A local administrator account, an existing administrator session, or console access. If RDP is unavailable, open the VPSLake client area at <code>https:\/\/my.vpslake.com<\/code>, launch the VPS control panel (Virtualizor), and use <strong>VNC Console<\/strong>.<\/li>\n\n\n<li>The server&#8217;s public IP address or DNS name, plus a second computer for testing the connection.<\/li>\n\n\n<li>No special RAM or disk allocation is needed; keep a VPS snapshot or backup available before changing remote-access settings.<\/li>\n\n\n<li>If you need a Windows server for this procedure, <a href=\"https:\/\/vpslake.com\/buy-windows-rdp\">VPSLake Windows RDP hosting<\/a> includes administrator access for remote management.<\/li>\n\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Step 1: Confirm whether the problem is the network or the RDP session<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Testing the port first prevents you from changing Windows settings when the connection is actually blocked upstream.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">From another Windows computer, open <strong>Windows PowerShell<\/strong> and run this command. Replace <code>SERVER_IP<\/code> with the VPS public IP or DNS name:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Test-NetConnection -ComputerName SERVER_IP -Port 3389<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Expected output includes:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ComputerName     : SERVER_IP\nRemotePort       : 3389\nTcpTestSucceeded : True<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><code>True<\/code> means the endpoint is reachable, but it does not prove that the RDP service is healthy. If it is <code>False<\/code>, keep the VPS control panel&#8217;s <strong>VNC Console<\/strong> open and continue; you will check the server-side firewall and listener in Step 4.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 2: Restart the Remote Desktop services<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">A stuck <code>TermService<\/code> process can leave the RDP listener in a bad state while Windows itself continues running, so restart the service from a console or a separate administrator session.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Open <strong>Windows PowerShell \u2192 Run as administrator<\/strong> on the server and check both services:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-Service -Name TermService,UmRdpService | Select-Object Name,DisplayName,Status,StartType<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The normal state is <code>Running<\/code> for both services. Restart the main service; Windows will also prompt to restart the Remote Desktop Services UserMode Port Redirector when that dependency is active:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Restart-Service -Name TermService -Force\nGet-Service -Name TermService,UmRdpService | Select-Object Name,Status<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Expected output:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Name          Status\n----          ------\nTermService   Running\nUmRdpService  Running<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">A service restart can terminate active RDP sessions, so do not run it from the only session you need for recovery unless the VPS console is ready. The same operation is available at <strong>Server Manager \u2192 Tools \u2192 Services \u2192 Remote Desktop Services \u2192 Restart<\/strong>. Microsoft\u2019s <a href=\"https:\/\/learn.microsoft.com\/en-us\/troubleshoot\/windows-server\/remote\/rdp-error-general-troubleshooting\" target=\"_blank\" rel=\"noopener\">RDP general troubleshooting guide<\/a> documents these services and the listener checks.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 3: Re-enable Remote Desktop without weakening NLA<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The error can follow an interrupted or inconsistent Remote Desktop setting; restore the allow-connection value and leave Network Level Authentication enabled.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In an elevated PowerShell window on the server, run:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>$TerminalServer = 'HKLM:\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server'\nSet-ItemProperty -Path $TerminalServer -Name fDenyTSConnections -Value 0\nEnable-NetFirewallRule -DisplayGroup 'Remote Desktop'\nGet-ItemProperty -Path $TerminalServer -Name fDenyTSConnections<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Expected output is:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>fDenyTSConnections\n------------------\n                 0<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The registry value <code>0<\/code> allows incoming RDP connections, and the firewall command enables Windows\u2019 built-in Remote Desktop rules. This does not turn off NLA, which should remain active for an internet-facing server.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For the graphical route, open <strong>Server Manager \u2192 Local Server \u2192 Remote Desktop<\/strong>, select <strong>Allow remote connections to this computer<\/strong>, keep <strong>Allow connections only from computers running Remote Desktop with Network Level Authentication (recommended)<\/strong> selected, and choose <strong>Apply \u2192 OK<\/strong>. If a domain Group Policy manages this setting, change the policy at <strong>Group Policy Management \u2192 Computer Configuration \u2192 Administrative Templates \u2192 Windows Components \u2192 Remote Desktop Services \u2192 Remote Desktop Session Host \u2192 Connections<\/strong> instead of repeatedly changing the local value. See Microsoft\u2019s <a href=\"https:\/\/learn.microsoft.com\/en-us\/windows-server\/remote\/remote-desktop-services\/remotepc\/remote-desktop-allow-access\" target=\"_blank\" rel=\"noopener\">Remote Desktop access guidance<\/a> for the supported setting.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 4: Check the listener and Windows Firewall<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">RDP is repaired only when <code>TermService<\/code> is running, a process is listening on the expected port, and an enabled inbound rule permits the traffic.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Run these checks on the server:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-NetTCPConnection -LocalPort 3389 -State Listen | Select-Object LocalAddress,LocalPort,State,OwningProcess\nGet-NetFirewallRule -DisplayGroup 'Remote Desktop' | Where-Object Enabled -eq $true | Select-Object DisplayName,Profile,Direction,Action\nGet-Service -Name TermService | Select-Object Name,Status,StartType<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Expected output contains a listener and an enabled allow rule:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>LocalAddress LocalPort State  OwningProcess\n------------ --------- -----  -------------\n0.0.0.0      3389      Listen 1234\n\nName        Status  StartType\n----        ------  ---------\nTermService Running Automatic<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">If your server uses a custom RDP port, replace <code>3389<\/code> in the listener and client tests with that port. Also allow the same port in any provider-side firewall or security group; Windows Defender Firewall cannot override a block outside the guest.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 5: Clear stale credentials on the client<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">When the server is reachable and healthy but only one computer shows the internal error, remove that computer\u2019s saved RDP credential and default connection profile.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Close every Remote Desktop Connection window on the client. Open <strong>Control Panel \u2192 Credential Manager \u2192 Windows Credentials<\/strong>, remove entries beginning with <code>TERMSRV\/<\/code> for this server, and select <strong>Remove<\/strong>. You can list saved entries from PowerShell as well:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>cmdkey \/list\ncmdkey \/delete:TERMSRV\/SERVER_IP<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Replace <code>SERVER_IP<\/code> with the address stored in the credential. If you normally connect by hostname, remove the matching <code>TERMSRV\/SERVER_NAME<\/code> entry too. To reset the client\u2019s default profile without deleting it, open PowerShell and run:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Rename-Item \"$env:USERPROFILE\\Documents\\Default.rdp\" \"Default.rdp.old\" -ErrorAction SilentlyContinue<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Start a fresh client session:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>mstsc.exe \/v:SERVER_IP<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Enter the username in the correct form, such as <code>SERVER_NAME\\ADMIN_USERNAME<\/code> for a local account or <code>DOMAIN\\USERNAME<\/code> for a domain account. Do not paste a password into a command or save credentials on a shared computer.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Verify the repaired connection<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">First confirm the server-side state, then connect from a different computer so the test does not reuse the broken client session:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-Service -Name TermService | Select-Object Status\nGet-NetTCPConnection -LocalPort 3389 -State Listen | Select-Object LocalPort,State\nTest-NetConnection -ComputerName SERVER_IP -Port 3389\nmstsc.exe \/v:SERVER_IP<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The first two checks should show <code>Running<\/code> and <code>Listen<\/code>, and the network test should report <code>TcpTestSucceeded : True<\/code>. The Remote Desktop client should then reach the sign-in screen and accept a permitted administrator or Remote Desktop Users account.<\/p>\n\n\n\n<aside class=\"vl-element vl-cta-banner\" aria-label=\"Need a Windows VPS?\">\n\t<div class=\"vl-cta-banner__content\">\n\t\t<p class=\"vl-cta-banner__eyebrow\">Windows server access<\/p>\n\t\t<h3 class=\"vl-cta-banner__title\">Need a Windows VPS?<\/h3>\n\t\t<p class=\"vl-cta-banner__text\">Get administrator access for RDP troubleshooting, firewall changes, and everyday server management.<\/p>\n\t<\/div>\n\t<a class=\"vl-cta-banner__button\" href=\"\/buy-windows-rdp\" aria-label=\"View Windows VPS\">View Windows VPS<\/a>\n<\/aside>\n\n\n\n<h2 class=\"wp-block-heading\">Troubleshooting<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">\u201cAn internal error has occurred\u201d returns immediately<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The client may be reusing a damaged saved credential or RDP profile, or <code>TermService<\/code> may still have a stale listener. Repeat Step 2 from <strong>VNC Console<\/strong>, complete Step 5 on the affected client, and reconnect with <code>mstsc.exe \/v:SERVER_IP<\/code>.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><code>TcpTestSucceeded : False<\/code><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The server is not reachable on the tested port. From the console, confirm the listener and enabled Remote Desktop firewall rules from Step 4, then check the VPS control panel\u2019s network firewall or security-group rules. If the listener is on a nonstandard port, test that port rather than 3389.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><code>Get-NetTCPConnection<\/code> returns no listener<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Remote Desktop Services may have failed to start, or a policy may still deny connections. Run <code>Get-Service TermService<\/code>, check <code>fDenyTSConnections<\/code> is <code>0<\/code>, restart <code>TermService<\/code>, and inspect <strong>Event Viewer \u2192 Applications and Services Logs \u2192 Microsoft \u2192 Windows \u2192 TerminalServices-LocalSessionManager \u2192 Operational<\/strong> for the first error at the failure time.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">The connection reaches sign-in but rejects the account<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">This is an authentication or permission issue, not the original transport error. Confirm the username prefix, verify the account is enabled and not locked, and add a non-administrator account through <strong>Server Manager \u2192 Tools \u2192 Computer Management \u2192 Local Users and Groups \u2192 Groups \u2192 Remote Desktop Users<\/strong>. Keep NLA enabled and correct the account or policy instead of disabling it.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Hardening<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li>Restrict the Windows Firewall Remote Desktop rules to trusted administrator IP addresses or a VPN when your network design permits it.<\/li>\n\n\n<li>Keep NLA, Windows updates, strong unique passwords, and account lockout monitoring enabled.<\/li>\n\n\n<li>Leave the VPS control panel\u2019s console available for recovery before changing the RDP port, firewall policy, or administrator account.<\/li>\n\n\n<li>Record the working RDP port and keep a second administrator or approved recovery method so one bad credential cannot lock you out.<\/li>\n\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">FAQ<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Does restarting Remote Desktop Services reboot the server?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">No. It restarts the RDP service and can disconnect active Remote Desktop sessions, but it does not restart Windows. Use the VPS console or a separate administrator session before restarting it.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Should I disable Network Level Authentication to fix this error?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">No. NLA requires authentication before Windows creates a full remote session and should stay enabled on an internet-facing server. Repair the service, listener, firewall, credentials, or account policy instead.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Why does RDP work from one computer but not another?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The server is probably reachable and the problem is local to the failing client, commonly a stale <code>TERMSRV<\/code> credential or corrupted <code>Default.rdp<\/code> profile. Remove only the saved entry for this server, rename the profile, and create a fresh connection.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Can I fix this without an RDP session?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Yes. Use the VPSLake client area to open the VPS control panel (Virtualizor), then choose <strong>VNC Console<\/strong>. From that local console, run the elevated PowerShell checks and service restart in this guide.<\/p>\n\n\n\n<script type=\"application\/ld+json\">{\"@context\": \"https:\/\/schema.org\", \"@type\": \"FAQPage\", \"mainEntity\": [{\"@type\": \"Question\", \"name\": \"Does restarting Remote Desktop Services reboot the server?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"No. It restarts the RDP service and can disconnect active Remote Desktop sessions, but it does not restart Windows. Use the VPS console or a separate administrator session before restarting it.\"}}, {\"@type\": \"Question\", \"name\": \"Should I disable Network Level Authentication to fix this error?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"No. NLA requires authentication before Windows creates a full remote session and should stay enabled on an internet-facing server. Repair the service, listener, firewall, credentials, or account policy instead.\"}}, {\"@type\": \"Question\", \"name\": \"Why does RDP work from one computer but not another?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"The server is probably reachable and the problem is local to the failing client, commonly a stale `TERMSRV` credential or corrupted `Default.rdp` profile. Remove only the saved entry for this server, rename the profile, and create a fresh connection.\"}}, {\"@type\": \"Question\", \"name\": \"Can I fix this without an RDP session?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"Yes. Use the VPSLake client area to open the VPS control panel (Virtualizor), then choose **VNC Console**. From that local console, run the elevated PowerShell checks and service restart in this guide.\"}}]}<\/script>\n\n","protected":false},"excerpt":{"rendered":"Fix the Windows RDP internal error on Windows Server 2016\u20132025 by restarting services, restoring settings, checking the listener, and testing access.","protected":false},"author":1,"featured_media":828,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"csco_singular_sidebar":"","csco_page_header_type":"","csco_page_load_nextpost":"","footnotes":""},"categories":[5,11],"tags":[32,23,58,42],"class_list":["post-827","post","type-post","status-publish","format-standard","has-post-thumbnail","category-guides","category-windows-server","tag-rdp","tag-remote-desktop","tag-troubleshooting","tag-windows-server","cs-entry"],"_links":{"self":[{"href":"https:\/\/vpslake.com\/blog\/wp-json\/wp\/v2\/posts\/827","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/vpslake.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/vpslake.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/vpslake.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/vpslake.com\/blog\/wp-json\/wp\/v2\/comments?post=827"}],"version-history":[{"count":1,"href":"https:\/\/vpslake.com\/blog\/wp-json\/wp\/v2\/posts\/827\/revisions"}],"predecessor-version":[{"id":3049,"href":"https:\/\/vpslake.com\/blog\/wp-json\/wp\/v2\/posts\/827\/revisions\/3049"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/vpslake.com\/blog\/wp-json\/wp\/v2\/media\/828"}],"wp:attachment":[{"href":"https:\/\/vpslake.com\/blog\/wp-json\/wp\/v2\/media?parent=827"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/vpslake.com\/blog\/wp-json\/wp\/v2\/categories?post=827"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/vpslake.com\/blog\/wp-json\/wp\/v2\/tags?post=827"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}