Fix Remote Desktop Access Denied on Windows

Remote Desktop (RDP) is a built-in Windows tool that lets you control another PC over the network. When it suddenly says “Access Denied,” it usually means a permissions, credential, or policy issue—not a hardware failure. This guide walks you through the most common fixes, from checking user permissions to adjusting group policy settings, so you can reconnect quickly.

What You’ll Need

Administrative access to the computer you’re trying to connect to (the host).
The username and password of an account that has permission to use Remote Desktop.
Network access between the two computers (same LAN or VPN).
Windows 10 or Windows 11 on both machines (the steps are similar on Windows Server, but menu names may vary slightly).

Step-by-Step

Confirm Remote Desktop is enabled on the host. On the target PC, go to Settings > System > Remote Desktop and toggle “Remote Desktop” to On. Note the PC name shown—you’ll need it to connect. If it’s already on, toggle it off and on again to refresh the service.
Check that your user account is in the Remote Desktop Users group. Open the Start menu, type Computer Management, and press Enter. In the left pane, expand System Tools > Local Users and Groups > Groups. Double-click “Remote Desktop Users.” If your username isn’t listed, click Add, type your username, and click Check Names to validate, then OK. If you’re an administrator, you might already have access, but adding explicitly is safer.
Verify the credentials you’re using. On the client (the PC you’re connecting from), ensure you’re typing the host’s username and password—not your local credentials. If the host is part of a domain, use DOMAIN\Username. If it’s a Microsoft account, use the email address associated with that account. Also, check that the password hasn’t expired or been changed recently.
Check the Remote Desktop service is running. On the host, press Win + R, type services.msc, and press Enter. Scroll to “Remote Desktop Services.” Its status should be “Running.” If not, right-click and select Start. Also check “Remote Desktop Configuration” and “Remote Desktop Services UserMode Port Redirector” are running.
Review the local security policy for RDP permissions. On the host, press Win + R, type secpol.msc, and press Enter. Go to Local Policies > User Rights Assignment. Double-click “Allow log on through Remote Desktop Services.” Ensure your user or group is listed. If not, click Add User or Group and add it. Also check “Deny log on through Remote Desktop Services” to make sure your account isn’t there (remove it if it is).
Clear the stored credentials on the client. On the connecting PC, open Credential Manager (search in Start). Under “Windows Credentials,” look for any entries starting with TERMSRV/ (e.g., TERMSRV/192.168.1.10). Remove them. These cached credentials often cause “Access Denied” when they’re outdated.
Try connecting with the IP address instead of the PC name. Sometimes DNS or NetBIOS resolution fails. On the client, open Remote Desktop Connection (mstsc), type the host’s IP address (e.g., 192.168.1.100) instead of the name. If that works, the issue is name resolution, not permissions.
Check the Windows Firewall rules. On the host, go to Control Panel > Windows Defender Firewall > Allow an app or feature through Windows Defender Firewall. Ensure “Remote Desktop” is checked for both Private and Public networks. If it’s not, click Change settings, then check it. If you’re on a domain network, the rule may be managed by Group Policy—contact your IT admin.
Restart the Remote Desktop services. On the host, open an elevated Command Prompt (right-click Start, select “Terminal (Admin)” or “Command Prompt (Admin)”) and run: net stop termservice then net start termservice. This resets the RDP stack without rebooting the whole PC.
Reboot the host. If all else fails, a simple restart clears many temporary glitches. After reboot, try connecting again.

Common Mistakes

Using the wrong username format. For a Microsoft account, the username is the full email address, not just the first name. For a local account, it’s the exact local username (case-insensitive but must match).
Forgetting to add the user to the Remote Desktop Users group. Even if the user is an administrator, some Windows versions require explicit membership in that group.
Having a conflicting “Deny” policy. A deny rule overrides an allow rule. Always check the “Deny log on through Remote Desktop Services” policy.
Stale cached credentials. The client may be sending old credentials that the host rejects. Always clear TERMSRV entries in Credential Manager.
Firewall blocking on a public network. If you’re on a public network, the firewall may block RDP even if it’s allowed on private networks. Ensure the rule is enabled for “Public” as well, if you trust the network.

Tips

Use the “Remote Desktop Users” group for multiple users. Instead of adding each user individually to the security policy, add them to the group once and manage access centrally.
Set a static IP address on the host. If you’re connecting via IP, a dynamic IP can change and break your saved connection. Set a static IP in the router or Windows network settings.
Enable Network Level Authentication (NLA). On the host, go to System Properties > Remote, check “Allow connections only from computers running Remote Desktop with Network Level Authentication.” This adds a security layer and often prevents “Access Denied” due to credential mismatches.
Test with a different client. If you have another PC or a phone with the Microsoft Remote Desktop app, try connecting from there. This helps isolate whether the problem is on the host or the client.
Keep Windows updated. RDP bugs are often fixed in cumulative updates. Check for updates on both machines.

Troubleshooting

If you’ve followed the steps and still get “Access Denied,” try these additional checks:

Check the Event Viewer. On the host, open Event Viewer (eventvwr.msc). Under Windows Logs > Security, look for events with ID 4625 (logon failure) or 4776. The details may reveal the exact reason—like “unknown user name or bad password.”
Test the credentials locally. On the host, log out and log back in with the same username and password you’re using for RDP. If you can’t log in locally, the credentials are wrong or the account is locked.
Check if the account is locked or disabled. In Computer Management, go to Local Users and Groups > Users, right-click your account, and check properties. Ensure “Account is disabled” is unchecked.
Verify the RDP port is listening. On the host, open Command Prompt and run netstat -an | findstr :3389. If you see LISTENING, the service is up. If not, the service may be stopped or the port changed.
Check if the host is in sleep mode. Remote Desktop won’t wake a sleeping PC. On the host, go to Settings > System > Power & sleep and set “Sleep” to “Never” while you’re troubleshooting.
Disable IPv6 if you’re using IPv4 addresses. Some network configurations have issues with IPv6. On the client, in the Remote Desktop connection, try the IPv4 address explicitly (e.g., 192.168.1.100).

Frequently Asked Questions

Why does Remote Desktop say “Access Denied” even though I’m an administrator?

Administrators are not automatically in the Remote Desktop Users group on all Windows versions. Add your account to that group explicitly, or check the local security policy to ensure “Allow log on through Remote Desktop Services” includes Administrators.

Can I fix “Access Denied” without restarting the host?

Yes, often you can. Try restarting the Remote Desktop Services (termservice) via the Services console or command line. Also, clearing cached credentials on the client can resolve the issue without a reboot.

Does the Remote Desktop password have to match my Windows password?

Yes, RDP uses your Windows login credentials. If you’re using a Microsoft account, the password is your Microsoft account password, which may differ from your local PIN.

Why does RDP work for one user but not another?

This usually means the other user is not in the Remote Desktop Users group or is blocked by a “Deny” policy. Check the group membership and the local security policy for that user.

Can a VPN cause “Access Denied” on Remote Desktop?

Yes, a VPN can sometimes interfere with authentication if it changes your IP or if the host’s firewall rules only allow specific IPs. Try connecting without the VPN (on the same LAN) to see if that’s the cause.

Is there a way to see the exact error message for “Access Denied”?

Yes, on the client, open Remote Desktop Connection, click “Show Options,” and look at the “Diagnostics” tab. It may show a more specific error code. Also, check the Event Viewer on the host for detailed logs.

General steps for current mainstream versions; menus can differ by device and version. See the disclaimer or report an error.

More in this bed

The whole Tech How-To bed →