Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
When Remote Desktop shows “Logon attempt failed”, Windows has rejected the sign-in, but the message does not identify whether the problem is the username format, account permission, identity provider, security policy, or the host itself. Work through the checks in this order: confirm the computer name and account format, verify that the account is allowed through Remote Desktop Users, then follow the branch for a Microsoft Entra joined computer, classic Active Directory, Credential Guard, or a third-party RDP broker. For Microsoft Entra joined hosts, same-tenant device state, PKU2U, and the unsupported per-user MFA path are decisive. If those checks do not resolve the failure, collect TSS logs from both client and server while reproducing it.
What does “Logon attempt failed” mean in Remote Desktop?
The text is a generic authentication result, not a diagnosis. Windows error status 0x8009030C (SEC_E_LOGON_DENIED) is documented as “The logon attempt failed.” It means the requested logon was denied, while leaving the underlying reason open.
As an Amazon Associate I earn from qualifying purchases.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Remote Desktop has several decision points that can all end with the same prompt:
- Target selection: the client may be connecting to a different computer than you intended, or to a name that does not match the device identity used by the sign-in method.
- Credential interpretation: a valid password can still fail when the username is written for the wrong identity system.
- Authentication policy: PKU2U, Network Level Authentication (NLA), Credential Guard, Protected Users restrictions, or a broker policy can reject a credential exchange.
- Authorization: the account may authenticate successfully but still lack permission to sign in through Remote Desktop.
- Host state: Remote Desktop may be disabled, the computer may be powered off, or it may be unreachable.
Because the prompt does not distinguish these cases, changing a password repeatedly or disabling security controls at random is unlikely to help. Identify the identity system first, then test the corresponding layer.
Popular on Amazon
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
How do I confirm the computer name and username format?
Start with the connection target and the exact account syntax. Open Remote Desktop Connection by running mstsc.exe; do not begin with a previously saved shortcut whose computer field may be stale.
- In Computer, enter the host name that resolves to the intended session host. Check the spelling and suffix, and verify that it is the same device name registered with the organization’s identity service when a web-account sign-in is used.
- For a Microsoft Entra account, enter the user principal name as
[email protected]or, where required by the client,AzureAD\[email protected]. A traditionaldomain\userform can fail against a Microsoft Entra joined computer because it addresses a classic Active Directory domain rather than the Entra identity. - When using the web-account option for a Microsoft Entra joined target, use the host name, not an IP address. That authentication mode requires the name associated with the device record.
- Remove an old saved credential and type the account again so that an earlier password or username cannot silently be reused.
If the computer name is an alias, test the device’s registered host name as a controlled comparison. Do not infer that a successful DNS lookup proves that the name is valid for every authentication mode; name matching and identity registration are separate checks.
How do I verify that Remote Desktop is enabled and that my account is authorized?
Authentication and authorization are separate. The password can be correct while the target still refuses the connection because the account or its group is not allowed to use Remote Desktop.
Confirm the host-side Remote Desktop setting
Use an administrator session on the target, or have the administrator do this check. In Windows Settings, open System > Remote Desktop and confirm that Remote Desktop is enabled. The computer must also be powered on and reachable from the client; an unavailable host can prevent a meaningful credential test.
Check membership in Remote Desktop Users
The local Remote Desktop Users group grants users and groups permission to connect remotely. Verify that the individual account or an allowed security group is a member, and check any organization policy that controls the user-right assignment for remote logon.
For an individual Microsoft Entra account, a local administrator can add the account from an elevated Command Prompt or PowerShell window:
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsAlso popular on Amazon
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
net localgroup "Remote Desktop Users" /add "AzureAD\<userUPN>"Replace <userUPN> with the complete sign-in name. The command requires local administrator rights. A successful command changes authorization; it does not repair an incorrect username format, a tenant mismatch, or a blocked authentication protocol.
Retest with a clean connection
Close the Remote Desktop client, open it again with mstsc.exe, enter the verified computer name, and supply the account in the format appropriate to the host. If the error changes after group membership is corrected, the original failure was at the authorization layer. If it remains identical, continue with the identity-specific branch below.
What should I check on a Microsoft Entra joined computer or Azure Virtual Desktop VM?
Microsoft Entra joined hosts add requirements that do not apply to every classic domain connection. Check the tenant relationship, PKU2U, and the MFA design before altering other settings.
Are the client and host joined to the same tenant?
The physical client and the session host should be Microsoft Entra joined or hybrid joined to the same tenant for the documented sign-in path. A machine joined to another tenant can resolve on the network and still reject an otherwise valid account because the identity authority is different. Confirm the join state on both devices and compare the tenant information with the account’s domain.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteIs PKU2U enabled on both devices?
Microsoft documents that PKU2U authentication requests must be enabled on both the client and the session host for this scenario. Check the local security policy or the organization’s equivalent management policy on each device. If one side blocks PKU2U, the credential exchange can fail before the account’s Remote Desktop permission is evaluated.
Is the sign-in account using unsupported per-user MFA?
Per-user MFA is not supported for Microsoft Entra joined VM sign-ins in this path. If the account is forced through that legacy per-user MFA setting, the connection can end at “The logon attempt failed.” Use a Conditional Access design supported by the environment instead of enabling per-user MFA for the VM sign-in account; involve the identity administrator before changing enforcement.
Also popular on Amazon
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
Should Network Level Authentication be changed?
NLA is recommended for ordinary remote connections because it authenticates the user before creating a full session. Microsoft documents a scenario in which a Microsoft Entra group added to Remote Desktop Users is not honored while NLA is enabled; disabling NLA can be used as a controlled diagnostic workaround for that specific case.
If you test this workaround, record the original setting, make the change only with administrative approval, reproduce the failure, and restore NLA immediately after the test unless the organization has an approved alternative. A successful test shows that the NLA-stage policy or group evaluation needs attention; it is not a reason to leave a production host permanently less protected.
Free tools Windows power users keep installed
One-click scans. No signup required.
How can classic Active Directory’s Protected Users group cause the failure?
On a classic Active Directory deployment, check whether the affected account is a member of the Protected Users security group. That group intentionally prevents several forms of credential caching and legacy credential use. In documented Remote Desktop Services scenarios, those restrictions can stop the credentials required by the connection from being available and produce a logon denial.
Ask an Active Directory administrator to verify the membership and the applicable domain policy. Do not remove the user from Protected Users as a routine troubleshooting step: first establish that the membership is the cause, obtain the organization’s security approval, and understand what protection the account will lose. If removal is approved, retest with a fresh session and then decide whether a supported authentication design can preserve the account’s security requirements.
A Protected Users finding applies to the classic AD branch. It does not explain a tenant mismatch on a Microsoft Entra joined computer, and removing the membership will not correct an AzureAD\user versus domain\user naming error.
Could Credential Guard or saved credentials be blocking the connection?
Credential Guard protects Windows credentials and prevents the Remote Desktop client from sending saved Windows credentials to a remote host. When a connection depends on those saved credentials, the client can display “Logon attempt failed” even though the password itself is valid.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Also popular on Amazon
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
- Open the Remote Desktop client and remove the stored credential for the affected computer from the Windows account-credential store, following the organization’s credential-management procedure.
- Start a new
mstsc.exesession and enter credentials interactively using a method permitted by the security policy. - If interactive entry is also blocked, have the administrator confirm whether Credential Guard is enforced and whether the selected authentication method is compatible with it.
Do not disable Credential Guard merely to make a saved password work. The control exists to stop reusable Windows credentials from being sent to a remote host; a workaround that weakens it can create a larger security problem than the original connection error.
What if a third-party RDP broker is prompting for a password?
Connections made through a privileged-access or RDP-broker product can apply an additional server policy. In the documented broker scenario, the policy named Always prompt for password upon connection blocks saved credentials.
On the session host, an administrator can inspect the setting at:
Computer Configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Security
If the broker’s approved design requires saved credentials, the documented resolution for that specific case is to set Always prompt for password upon connection to Disabled. Apply the change only after the organization has reviewed the security implications; a broker may intentionally require a fresh password prompt. If the policy is already disabled, return to the broker’s own authentication and account-mapping logs rather than changing unrelated Windows settings.
How do I collect useful diagnostics when the basic checks do not work?
When the identity and policy branches do not resolve the problem, collect evidence from both ends of the connection. A client-only capture cannot show how the server evaluated the account, and a server-only capture can miss the credential format or protocol selected by the client.
Also popular on Amazon
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Use Microsoft’s RDS TSS scenarios
Run the tools with administrative rights, reproduce the failure while collection is active, and follow your organization’s procedure for transferring the resulting files securely:
Client: .\TSS.ps1 -Scenario UEX_RDScli
Server: .\TSS.ps1 -Scenario UEX_RDSsrv -UEX_Auth -UEX_Logon -UEX_RDSProfiles -UEX_RDSScard -Mode BasicThe client scenario records the connection-side behavior. The server scenario adds authentication, logon, profile, and smart-card-related parameters in Basic mode, which is the combination Microsoft identifies for authentication errors such as “Logon attempt failed” or “An internal error has occurred.”
What should be recorded with the capture?
- The UTC time of a fresh reproduction and the exact computer name entered in
mstsc.exe. - The account format used, without recording the password.
- Whether the host is classic AD, Microsoft Entra joined, hybrid joined, or an Azure Virtual Desktop session host.
- Whether NLA, PKU2U, Credential Guard, Protected Users membership, or a broker policy was changed during testing.
- The resulting TSS packages from both client and server, preserved together so an administrator can correlate the two sides.
Microsoft’s troubleshooting guidance also lists non-authentication causes such as Remote Desktop being disabled, the host being powered off, or the host being unavailable on the network. Include those checks in the incident record so the authentication evidence is not interpreted in isolation.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Which troubleshooting path fits my environment?
Use the identity system to choose the first branch. The same visible message can arise at different layers, so a fix that is correct for one environment can be irrelevant or unsafe in another.
| Environment | First authentication checks | Authorization check | Best evidence when unresolved |
|---|---|---|---|
| Classic Active Directory | Use the domain account format; check Protected Users restrictions and the negotiated policy. | Confirm the account or its group is allowed through Remote Desktop Users and the applicable user-right assignment. | Client and server TSS captures, plus the domain and host policy settings. |
| Microsoft Entra joined host | Use [email protected] or AzureAD\[email protected]; verify same-tenant join, PKU2U on both devices, and no unsupported per-user MFA for VM sign-in. |
Add the Microsoft Entra account or group to Remote Desktop Users; verify the host name rather than an IP for web-account authentication. | Client/server TSS captures and the tenant, join-state, and sign-in policy details. |
| Azure Virtual Desktop session host | Apply the Microsoft Entra joined checks when the host uses that identity path; review NLA and the approved Conditional Access design. | Verify the account or group has the required remote-login permission on the session host. | Both TSS packages, session-host state, and identity-policy records. |
| Third-party RDP broker | Check the broker’s credential method and the Always prompt for password upon connection policy. | Confirm the broker maps the user to an account permitted on the target. | Broker policy and authentication logs together with client/server TSS data. |
| Credential Guard enabled | Do not rely on saved Windows credentials; enter an approved interactive credential or use a compatible authentication design. | Confirm Remote Desktop Users membership separately. | Credential Guard configuration, clean-session results, and both TSS packages. |
What mistakes make the error harder to diagnose?
- Trying every username format: record which identity system owns the host, then use the format for that system. Randomly alternating between local, domain, and Entra prefixes obscures the test.
- Using an IP address with web-account authentication: this bypasses the host-name requirement for that mode and can create a failure that looks like a bad password.
- Adding a user to Remote Desktop Users and stopping there: group membership fixes authorization only. Tenant, PKU2U, MFA, Credential Guard, or Protected Users restrictions can still deny the logon.
- Disabling NLA or Credential Guard permanently: use any relaxation only as an approved, time-limited diagnostic and restore the protection after the comparison.
- Collecting logs from one side: authentication is a conversation between client and server. Capture both while reproducing the same attempt.
- Testing with an old saved session: close the client, remove stale credentials where policy permits, and start a new
mstsc.exesession so the result reflects the current settings.
What is the shortest safe recovery sequence?
For a routine incident, follow this order and stop when the failure is explained:
- Confirm the intended host name and verify that it is reachable and powered on.
- Open
mstsc.exeand use the account format required by the host’s identity system. - Confirm Remote Desktop is enabled and the account or group is authorized through Remote Desktop Users.
- If the host is Microsoft Entra joined, verify same-tenant join, PKU2U on both sides, and the supported MFA design; test the documented NLA workaround only under change control.
- If the host uses classic AD, check Protected Users membership before changing it.
- Check Credential Guard and remove stale saved credentials rather than weakening the protection.
- For brokered connections, inspect the password-prompt policy and broker mapping.
- Run the client and server TSS scenarios during a fresh reproduction when no branch explains the denial.
Frequently Asked Questions
Does this message prove that the password is wrong?
No. The Windows status 0x8009030C records a denied logon but does not identify the reason. A correct password can still be rejected by account authorization, tenant and device state, credential-protection policy, or the broker handling the connection.
Recommended Free Tools
Can I leave Network Level Authentication disabled after it lets me connect?
Only if an administrator has approved an alternative security design. The documented NLA change is a scenario-specific diagnostic for Microsoft Entra group evaluation; restore the stronger setting after testing whenever the environment supports it.
Should I remove a user from Protected Users to get RDP working?
Not automatically. First verify that the membership explains the failure, obtain security approval, and document the protection the account would lose; then test an approved change or a compatible authentication method.
What should I preserve before escalating the incident?
Keep the exact host name, account format, reproduction time, identity-join state, policy changes, and the client and server TSS packages together. Never include the user’s password in the incident record.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
