Verify Local Device Settings
The most common reason for this issue is that the local configuration has not been updated to match the domain policy. Windows 11 requires an explicit toggle to allow incoming Remote Desktop Protocol (RDP) connections. If this switch remains off, the system will reject connections regardless of what the Domain Controller dictates. Navigate to Settings > System > Remote Desktop. Look for the toggle labeled Enable Remote Desktop. If it is set to Off, click it to turn it On. You may need to confirm with administrative privileges. Once enabled, a warning dialog might appear asking to allow public network access; select Yes to permit connections from both private and public networks, depending on your security requirements. If the toggle is already On but connections still fail, proceed to check the advanced settings within this same menu. Click Advanced settings and ensure that Require computers to use Network Level Authentication (NLA) is checked. NLA adds a layer of security by authenticating users before establishing a full RDP session. Disabling NLA can resolve compatibility issues with older clients but reduces security. For modern Windows 11 environments, keeping NLA enabled is recommended unless you are connecting from legacy systems that do not support it.Configure Group Policy Objects Correctly
Even though the Default Domain Policy allows RDP, local group policy settings can override domain-wide configurations. You must verify that no local policy is blocking the service. Open the Local Group Policy Editor by runninggpedit.msc in the Run dialog. Navigate to Computer Configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Connections.
Ensure that the policy Allow users to connect remotely by using Remote Desktop Services is set to Enabled. If it is set to Not Configured or Disabled, it may take precedence over the domain policy in certain contexts. Additionally, check the Select Remote Desktop Users policy under Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Authorization. Verify that the appropriate user groups, such as Remote Desktop Users, are listed here. If the local policy is stricter than the domain policy, it will block access.
For domain-joined machines, it is best practice to enforce these settings via Group Policy rather than manual configuration. Create a specific GPO linked to the organizational unit containing the Windows 11 devices. Configure the same paths mentioned above within the domain controller's Group Policy Management Console. Force a policy update on the client machine by running gpupdate /force in an elevated command prompt. This ensures that the latest domain settings are applied immediately without waiting for the standard refresh interval.
Check Windows Firewall Rules
Firewall misconfigurations are a frequent cause of connection failures. The Windows Firewall must explicitly allow inbound traffic on TCP port 3389. Open Windows Defender Firewall with Advanced Security and navigate to Inbound Rules. Locate the rule named Remote Desktop - User Mode (TCP-In). Ensure that this rule is Enabled and applies to the correct profiles (Domain, Private, or Public). If the rule is disabled, right-click it and select Enable Rule. If the rule does not exist, you may need to recreate it or re-enable Remote Desktop, which should automatically generate the necessary firewall exceptions. Verify that no third-party antivirus software is blocking port 3389. Many security suites include their own firewalls that can interfere with Windows Firewall rules. Check your antivirus settings to ensure that Remote Desktop is whitelisted or that its firewall component is allowing RDP traffic. You can also test connectivity using theTest-NetConnection cmdlet in PowerShell. Run Test-NetConnection -ComputerName <TargetIP> -Port 3389 from another machine. If the TcpTestSucceeded property returns False, there is a network-level block. This could be due to a router, firewall appliance, or ISP restriction. If it returns True, the issue lies within the OS configuration or authentication methods.
Authentication and User Permissions
Ensure that the user attempting to connect has permission to log in remotely. By default, members of the Administrators and Remote Desktop Users groups have this permission. Add any specific users who need access to the Remote Desktop Users group on the target machine. You can do this via System Properties > Remote > Select Users or using thenet localgroup command.
If you are using a Microsoft Account to sign in, ensure that it is linked to the device properly. Sometimes, domain accounts may face authentication delays or failures if Kerberos tickets are not refreshed. Try disconnecting and reconnecting to the network, or restart the Remote Desktop Services via services.msc. Restarting the service can clear stuck sessions and apply recent policy changes.
For deeper troubleshooting, review the Event Viewer on the target machine. Open Event Viewer > Applications and Services Logs > Microsoft > Windows > TerminalServices-LocalSessionManager. Look for error events that provide specific reasons for connection rejection. Common errors include authentication failures or policy violations. These logs provide precise details that can guide further resolution steps.
Windows 11: Two PCs Won't Connect via Remote Desktop provides additional insights into multi-device connectivity issues.
Frequently Asked Questions
Why does Remote Desktop work on some PCs but not others in the same domain?
Local group policy settings or firewall rules on individual devices can override domain policies. Each PC must have the local "Allow remote connections" setting enabled and the corresponding firewall rule active.
Can I enable Remote Desktop using Command Prompt instead of Settings?
Yes, you can use PowerShell or CMD with administrative privileges. Run reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f to enable it, then restart the Remote Desktop Services.
What causes Error 0x4 when connecting via Remote Desktop?
Error 0x4 typically indicates a network connectivity issue or a firewall blocking the connection. Ensure that TCP port 3389 is open and that the target machine is reachable on the network.
Windows Remote Desktop Client Fails to Connect explains how to resolve specific client-side errors like 0x4.Is Network Level Authentication (NLA) required for all Remote Desktop connections?
NLA is highly recommended for security but can be disabled if connecting from legacy systems. However, disabling it exposes the system to potential brute-force attacks before authentication occurs.
How do I add a user to the Remote Desktop Users group via PowerShell?
Use the command Add-LocalGroupMember -Group "Remote Desktop Users" -Member "Username". Replace "Username" with the actual account name or SID that requires remote access permissions.