✅ 1. Check Basic Connectivity

• Ping the remote machine:

ping <rdp_ip_or_hostname>

If unreachable, you may have a network issue or the machine may be offline.

Try telnet on port 3389 (RDP port):

telnet <remote_ip> 3389

• If it fails, the port may be blocked or RDP is not running.

✅ 2. Verify RDP Is Enabled

• On the remote Windows system:
  • Open System Properties → Remote tab.
  • Ensure “Allow remote connections to this computer” is checked.
  • Also ensure “Allow connections only from computers running Remote Desktop with Network Level Authentication” is configured appropriately.

✅ 3. Check Firewall Settings

• On the remote machine:
  • Open Windows Defender Firewall.
  • Ensure Inbound Rule for “Remote Desktop (TCP-In)” is enabled.

Or run this in PowerShell:

Enable-NetFirewallRule -DisplayGroup “Remote Desktop”

✅ 4. Confirm the User Is Allowed

• User must be a member of:
  • Administrators group, or
  • Remote Desktop Users group.

You can add a user with:

Add-LocalGroupMember -Group “Remote Desktop Users” -Member “your_username”

✅ 5. RDP Service Status

• Make sure TermService (Remote Desktop Services) is running:

Get-Service -Name TermService

If not, start it:

Start-Service -Name TermService

✅ 6. IP Address / DNS Issues

• If you’re using a hostname, try connecting via IP.
• Flush DNS cache:

ipconfig /flushdns

✅ 7. Remote Machine Reboot or Stuck

• If all else fails and you have another access method (like SSH, ILO, or VMware), try rebooting the remote system.

PowerShell diagnostic script you can run on the remote Windows machine (via local access, SSH, or another method) to help identify why RDP isn’t working.

🛠️ PowerShell RDP Diagnostic Script

RDP Diagnostic Script

$log = “C:\RDP_Diagnostic_$(Get-Date -Format ‘yyyyMMdd_HHmmss’).log”
function Log($message) {
Write-Output $message
Add-Content -Path $log -Value $message
}

Log “=== RDP Diagnostics – $(Get-Date) ===”

1. Check if RDP is enabled in system settings

$rdpReg = Get-ItemProperty -Path “HKLM:\System\CurrentControlSet\Control\Terminal Server” -Name “fDenyTSConnections”
if ($rdpReg.fDenyTSConnections -eq 0) {
Log “✔ RDP is enabled in system settings.”
} else {
Log “❌ RDP is DISABLED in system settings.”
}

2. Check if TermService (RDP service) is running

$service = Get-Service -Name TermService
if ($service.Status -eq “Running”) {
Log “✔ Remote Desktop Services (TermService) is running.”
} else {
Log “❌ TermService is NOT running. Current status: $($service.Status)”
}

3. Check firewall rule

$firewallRule = Get-NetFirewallRule -DisplayGroup “Remote Desktop” -Enabled True -Action Allow
if ($firewallRule) {
Log “✔ Firewall rules for Remote Desktop are enabled.”
} else {
Log “❌ No firewall rules found for Remote Desktop or they are disabled.”
}

4. Check TCP port 3389 is listening

$rdpPort = Get-NetTCPConnection -LocalPort 3389 -State Listen -ErrorAction SilentlyContinue
if ($rdpPort) {
Log “✔ TCP port 3389 is listening.”
} else {
Log “❌ TCP port 3389 is NOT listening.”
}

5. Check user group membership

$currentUser = [System.Security.Principal.WindowsIdentity]::GetCurrent().Name
$rdpGroup = Get-LocalGroupMember -Group “Remote Desktop Users” -ErrorAction SilentlyContinue
if ($rdpGroup -and $rdpGroup.Name -contains $currentUser) {
Log “✔ Current user is a member of ‘Remote Desktop Users’.”
} else {
Log “⚠ Current user is NOT in ‘Remote Desktop Users’.”
}

Log “=== Diagnostics Complete. Log saved to $log ===”

✅ How to Use

1. Save as RDP_Diag.ps1.
2. Run as Administrator on the remote machine:

powershell -ExecutionPolicy Bypass -File RDP_Diag.ps1