Azure VM RDP connection fails with authentication error

Since restarting the VM and verifying NSG rules were already done, check the VM-side RDP authentication settings next.

1. Reset RDP configuration in the Azure portal Go to Virtual Machines > the VM > Help > Reset password. Set Mode to Reset configuration only, then select Update. This resets RDP configuration if Remote Connections are disabled or Windows Firewall rules are blocking RDP.
2. Check for NLA-related authentication issues NLA can block RDP access for several reasons, including:
   • the VM cannot communicate with the domain controller
   • the VM has a broken Active Directory security channel
   • the VM account password is out of sync with the domain controller
   • the domain controller is unhealthy
   • the VM requires a higher encryption level than the client uses
   • TLS 1.0, 1.1, or 1.2 server protocols are disabled on the VM
   • the VM is configured to allow only FIPS-compliant algorithm connections
3. If the VM is domain-joined, prevent Group Policy from immediately reverting changes Before troubleshooting, stop the Group Policy Client service:

      REG add "HKLM\SYSTEM\CurrentControlSet\Services\gpsvc" /v Start /t REG_DWORD /d 4 /f
   

   After the issue is fixed, restore it:

      sc config gpsvc start= auto
      sc start gpsvc
      gpupdate /force
   

   If the setting gets reverted again, an Active Directory policy is causing the problem.
4. Temporarily disable NLA as a workaround This reduces security and should be used only temporarily for troubleshooting.

      reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v UserAuthentication /t REG_DWORD /d 0
   

   Then restart the VM and test RDP again. After resolving the issue, re-enable NLA and restart the VM:

      REG add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v disabledomaincreds /t REG_DWORD /d 0 /f
      REG add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v UserAuthentication /t REG_DWORD /d 1 /f
   

5. Check TLS protocol settings on the VM Query the enabled state for the TLS server protocols used by RDP:

      reg query "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS x.x\Server" /v Enabled
   

   If the returned value is not 1, that protocol is disabled and must be enabled.
6. Check FIPS enforcement and RDP encryption level Query FIPS mode:

      reg query "HKLM\SYSTEM\CurrentControlSet\Control\Lsa\FIPSAlgorithmPolicy" /v Enabled
   

   If it returns 1, change it to 0. Query the current RDP minimum encryption level:

      reg query "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v MinEncryptionLevel
   

   If it returns 4, change it to 2 and restart the VM.
7. Check general VM diagnostics if authentication settings are not the cause In the Azure portal, review:
   • Boot diagnostics for startup or OS issues
   • Resource health to confirm the VM is reported as Available
   • Reset NIC if there may be a network interface issue
   • Reset password if local administrator credentials may be affected

If the problem is specifically an authentication error, the most relevant next checks are NLA, domain communication, TLS, FIPS, and MinEncryptionLevel.

References:

• Troubleshoot Remote Desktop connections to an Azure virtual machine
• Troubleshoot authentication errors when you use RDP to connect to Azure VM