Unable to Add Users/Groups from Trusted Domain to RDS Deployment (SID Resolution Error) and Published RemoteApps Failing with Error 0x300000d

Question

Unable to Add Users/Groups from Trusted Domain to RDS Deployment (SID Resolution Error) and Published RemoteApps Failing with Error 0x300000d

Vikrant 21

Hello,

I am experiencing issues in my Remote Desktop Services (RDS) environment involving users and groups from a trusted domain.

Environment:

Windows Server RDS Deployment
RDS1
- RD Connection Broker
- RD Licensing
- RD Web Access
- RD Gateway
RDS2
- RD Session Host
RDS3
- RD Session Host

There is an active Forest two-way trust configured between the domains.

Issue 1: Unable to Add Trusted Domain Users/Groups to RDS Deployment

When attempting to add users or groups from the trusted domain to the RDS deployment, I receive the following error:

The security identifier could not be resolved. Ensure that a two-way trust exists for the domain of the selected users.

Exception: The network path was not found.

Although the trust relationship appears to be configured correctly, RDS is unable to resolve the SID of users or groups from the trusted domain.

Issue 2: Unable to Resolve Trusted Domain Objects

When attempting to browse or add users/groups from the trusted domain using "Select Users, Computers, Service Accounts or Groups", I encounter the following error:

The following error occurred while using the user name and password you entered:

The user name or password is incorrect.

Note: This occurs even when valid credentials from the trusted domain are provided.

Issue 3: Published RemoteApps Not Launching

Additionally, users are unable to launch published RemoteApps. The RemoteApp client displays:

RemoteApp Disconnected

The remote resource can't be reached. Check your connection and try again or ask your network administrator for help.

Error code: 0x300000d

Extended error code: 0x0

Troubleshooting Performed:

Verified that a two-way trust exists between the domains.
Confirmed users can authenticate within their own domains.
Attempted to add both individual users and security groups from the trusted domain.
Tested using credentials from both domains when browsing AD objects.

Questions:

What additional checks should be performed to verify SID resolution across the trust?
Could DNS resolution or firewall communication between the domains cause the "The network path was not found" error?
Are there specific ports/services required by RD Connection Broker to enumerate users and groups from a trusted domain?
Could the RemoteApp error (0x300000d) be related to the inability to resolve users/groups across the trust?
What is the recommended method to validate that the Connection Broker can properly query domain controllers in the trusted domain?

Any guidance or recommendations would be greatly appreciated.

Thanks in advance.

Vikrant...

0 comments

1 answer

Your answer

Answer 1

Hello,

The errors you’re seeing point to a breakdown in how the RD Connection Broker and Session Hosts are resolving security identifiers across the forest trust. Even though the trust is two‑way, RDS relies heavily on proper DNS resolution, RPC/LDAP connectivity, and SID translation between domain controllers. Let’s address each of your issues in context.

For the “security identifier could not be resolved” and “network path was not found” errors, the most common cause is DNS misconfiguration. The Connection Broker must be able to resolve the fully qualified domain names of the trusted domain controllers. Verify that conditional forwarders or stub zones exist for each domain in the opposite forest, and confirm that nslookup against the trusted domain controllers works from RDS1. Also ensure that the firewall allows RPC (TCP 135), LDAP (TCP/UDP 389), Kerberos (TCP/UDP 88), and the ephemeral RPC range (TCP 49152–65535 by default). If any of these are blocked, SID resolution will fail with exactly the error you’re seeing.

The “username or password is incorrect” error when browsing objects is misleading. It usually indicates that the RDS server is unable to contact a domain controller in the trusted domain to validate the credentials. Run nltest /dsgetdc:<TrustedDomain> from RDS1 and RDS2 to confirm that a domain controller is being located. If this fails, it’s either DNS or firewall. Also check that the RDS servers are not restricted by the “Deny logon locally” or “Deny logon through Remote Desktop Services” policies for the trusted domain accounts.

Regarding the RemoteApp disconnection error (0x300000d), yes, this is often a downstream effect of the Connection Broker not being able to resolve and authorize the user’s SID from the trusted domain. If the Broker cannot enumerate the user or group membership, it cannot issue the proper RDP file or feed, and the client will fail with that error. Once SID resolution is fixed, the RemoteApp launch issue should clear.

To validate that the Connection Broker can query the trusted domain, use wbemtest or ldp.exe from RDS1 to bind against a domain controller in the trusted domain using a trusted domain account. If the bind fails, you know it’s a connectivity or authentication issue. Also, check the Broker logs under Applications and Services Logs > Microsoft > Windows > TerminalServices-SessionBroker for Event IDs 1296 and 1297, which will show domain resolution failures.

In short, the next checks should be: confirm DNS forwarders/stub zones, verify Kerberos and LDAP ports are open between forests, run nltest to ensure domain controllers are discoverable, and test LDAP binds manually. Once those succeed, adding trusted domain users/groups should work, and RemoteApp publishing will function correctly.

I hope you've found something useful here. If it helps you get more insight into the issue, it's appreciated to accept the answer. Should you have more questions, feel free to leave a message. Have a nice day!

HP.