Remote Desktop login failure after 1+ hour of active session

Question

Remote Desktop login failure after 1+ hour of active session

Martin Ritter 0

We use a shared account to connect to multiple PCs via Remote Desktop (using RDCMan).

When a session has been open for longer than ~1 hour and we try to start a second parallel session, the password is rejected.

Closing the first session allows both connections to work again with the same credentials.

We already tried these solutions, but none of them worked:

Cleared the entries in Windows Credential manager
Manually refreshed the token via CMD dsregcmd /refreshprt klist purge
Try the legacy mstsc.exe
Tried web login for mstsc.ece or RDCMan

0 comments

3 answers

Your answer

Answer 1

The described behavior matches known issues where Remote Desktop authentication or credential handling fails under certain conditions, especially when multiple sessions or reauthentication are involved.

Based on the available information, focus on these areas:

Check for policies that force re-prompting for credentials If the target machines are configured to always prompt for a password after a connection is established, or to re-prompt under certain security conditions, the second session may fail authentication while the first one is active. On affected machines, review the following registry locations and policies (via Group Policy or local policy):
- Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services
  - Look for values such as fPromptForPassword, SecurityLayer, and UserAuthentication.
- Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
  - Check or define the same values (fPromptForPassword, SecurityLayer, UserAuthentication).
If fPromptForPassword is set to 1, or SecurityLayer/UserAuthentication are configured to force additional credential checks, coordinate with the domain/IT administrator to adjust these policies so that RDP does not require an extra password prompt after the connection is established. This aligns with the documented guidance for resolving credential prompts that occur after RDP connection establishment.
Verify that users are not being forced to authenticate twice Some Windows builds and patch levels have known issues where users must enter credentials twice or see additional prompts when connecting via RDP. If the target PCs or RDS servers are not fully patched, this can manifest as intermittent or session-length–dependent authentication problems. Ensure that:
- All Remote Desktop Session Hosts / target PCs are fully updated with the relevant cumulative updates described for scenarios where users must authenticate twice.
- Any environment using CredSSP hardening or “Encryption Oracle Remediation” policies is configured according to the guidance, and that temporary workarounds (such as setting the policy to Vulnerable or relaxing NLA/security layer requirements) are only used if necessary and with awareness of the security implications.
Check for network or domain connectivity issues affecting authentication If the remote machines intermittently lose connectivity to domain controllers or experience TCP port exhaustion, authentication can fail in ways that appear time-based (for example, after the session has been active for some time or when additional connections are attempted). On the affected machines, review the System event log for:
- Group Policy failures (for example, Event ID 1129 from Group Policy indicating lack of connectivity to a domain controller).
- TCP/IP port exhaustion or related errors (for example, Event IDs 4227, 4231 from Tcpip).
- NETLOGON errors (for example, Event ID 5719 indicating the machine cannot set up a secure session with a domain controller).
If such events are present, investigate and remediate the underlying network or port exhaustion issue, then test RDP again.
Confirm that no 802.1x user-auth–only configuration is interfering If the environment uses 802.1x and is configured for user authentication only, remote desktop sessions can lose connectivity or fail after some time because the supplicant cannot properly use the user token in an RDP session. In such a case, reconfigure 802.1x to use computer authentication or User or computer authentication so that RDP connections remain stable and authentication continues to work when additional sessions are opened.
If Remote Credential Guard or advanced protections are in use In environments using Windows Defender Remote Credential Guard with multiple RD Connection Brokers, users can be denied access due to Kerberos-only restrictions. If this matches the deployment (high-availability RD Connection Brokers with load balancing), temporarily disabling Remote Credential Guard on affected clients can be used as a workaround while further design changes are considered.

After applying the relevant checks and changes above (especially around RDP credential prompting policies and patch levels), retest opening a second parallel session after an hour-long active session to confirm whether the authentication failure is resolved.

References:

Answer 2

Hi Martin Ritter,

The authentication failure occurring at the one-hour mark is fundamentally tied to Network Level Authentication and how the Local Security Authority Subsystem Service manages the credential cache for concurrent remote connections. When your initial session remains active, the remote host automatically renews the security token and updates its internal cache via the LSASS.exe process. If you attempt a second connection using the exact same shared account, Network Level Authentication evaluates the incoming credentials against this newly rolled-over cryptographic token, perceives a mismatch in the synchronization state, and outright rejects the password. This background process often generates an Event ID 4625 in your Windows security logs, which serves as the system's way of recording a logon failure despite the password being technically correct.

Because this token desynchronization happens entirely on the remote server's side, standard local administrative interventions like clearing your credential manager or using command-line tools to manually refresh local primary refresh tokens will not bypass the block. Many third-party forums suggest bypassing this known architectural limitation by disabling Network Level Authentication entirely through the registry pathway located at HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp by altering the UserAuthentication value. However, this registry key controls the primary gateway for connection security, and modifying it strips away a critical layer of encryption, exposing your remote desktop infrastructure to severe vulnerabilities and directly violating enterprise security compliance.

There is currently no authorized system configuration change that safely mitigates this token collision for shared identities without severely compromising your environment's security posture. You will need to wait for an official Microsoft update that specifically refines concurrent token handling for shared accounts within the current authentication framework. In the meantime, the most reliable and fully compliant operational approach is to provision unique, individual accounts for each user requiring remote access, which natively prevents these credential cache overlaps and ensures stable connectivity.

Hope this answer has brought you some useful information. If it did, please hit “accept answer”. Should you have any questions, feel free to leave a comment.

VPHAN

Martin Ritter 0 Reputation points

2026-06-18T10:58:37.5466667+00:00

Hi @VPHAN

thanks for the hints. We already have disabled for testing the Network Level Authentication.

In our case this did not make a difference.

Do you have another idea then what the root cause could be?

Answer 3

Martin Ritter When you use a shared account to connect to multiple remote PCs, your client machine relies on the internal Windows Web Account Manager and the Azure Active Directory Broker Plugin to issue access tokens for those connections. At exactly the one-hour mark, the first active session's access token expires, prompting Windows to quietly request a renewal in the background. During this renewal process, the authentication broker essentially locks the token state for that specific shared identity to prevent corruption. If you attempt to launch a second parallel session through RDCMan while this background refresh is actively occurring, the broker cannot process the concurrent request for the same identity. The system defaults to rejecting the connection entirely, which visually surfaces to you as a generic password rejection.

This also explains why closing the initial connection resolves the problem. When you close the first session, you forcefully terminate that background renewal lock, which clears the broker's queue and allows fresh access tokens to be successfully generated for your subsequent connections. You can actually verify this internal traffic collision by checking your Event Viewer under Applications and Services Logs, Microsoft, Windows, AAD, and Operational, where you will likely see overlapping token acquisition errors for the shared account during that one-hour mark.

Because this is an inherent concurrency limitation of the Web Account Manager when handling shared identities across multiple sessions, there is no registry key or command-line tool that will override the broker's locking mechanism. The official architectural guidance remains to provision unique, individual accounts for each user requiring remote access. If that is strictly not possible for your business model, you will have to wait for an official Microsoft update that redesigns how the underlying broker queues concurrent token requests for a single identity.

Hope this answer has brought you some useful information. If it did, please hit “accept answer”. Should you have any questions, feel free to leave a comment.

VPHAN