Every Windows 10 SKU from Home through Enterprise ships mstsc.exe, so the client side of a Remote Desktop connection to a Windows Server host requires no download. What breaks first connections is almost always one of four things: the server is not listening, the provider firewall drops TCP 3389, CredSSP negotiation fails because the Windows 10 client is missing a patch that raised its security level, or the account named in the logon dialog does not have the “Allow log on through Remote Desktop Services” right. This guide covers client configuration on Windows 10 (20H2 through 22H2), the exact registry and Group Policy values that govern CredSSP, and the fix for each error string you will actually see.
Preflight: What the Server Must Have Before the Client Can Connect
Confirm these on the server before touching the Windows 10 machine, because no client setting can compensate for a missing listener:
- Listening socket:
Get-NetTCPConnection -LocalPort 3389 -State Listenmust return one entry. If it is empty, theTermServiceservice is stopped or the “fDenyTSConnections” registry value underHKLM\SYSTEM\CurrentControlSet\Control\Terminal Serveris set to 1. - Local firewall: the “Remote Desktop – User Mode (TCP-In)” rule in the Remote Desktop group must be enabled for the Domain and Private profiles — and for Public if the provider puts the NIC on a public network profile, which most templates do.
- Group membership: the account needs to be in
Remote Desktop UsersorAdministrators. Server 2019 and 2022 templates often ship with the built-in Administrator renamed and the RDP group empty. - Provider edge: many Windows host providers manage a separate security group in front of the guest OS. A guest that accepts SYN on 3389 internally can still be unreachable if that edge rule is missing.
Client Settings in mstsc.exe That Actually Change Behaviour
Open mstsc.exe from %SystemRoot%\System32. The General tab takes the hostname or IP plus :port when the listener was moved off 3389. The Display tab matters more than it looks: at 100% scaling a 1920×1080 client requests a 1920×1080 session, but on a laptop at 150% DPI without “Use all my monitors”, mstsc reports a smaller virtual resolution and the desktop appears cropped. Set the slider to “Full screen” and tick the multi-monitor box only when both displays run the same scaling factor.
The Experience tab drives measurable bandwidth. On a link under 10 Mbps, selecting “Modem (56 kbps)” disables font smoothing, desktop composition, and visual styles — the session looks dated but input latency drops noticeably. On a LAN-grade link, “LAN (10 Mbps or higher)” with persistent bitmap caching enabled cuts repeated-region repaints. The Local Resources tab is where clipboard, drive, and printer redirection live; each redirection adds a virtual channel to the session and each channel has its own failure mode, which is why a drive redirection that stalls can freeze Explorer until the timeout expires.
Windows Registry Editor Version 5.00
[HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default]
"MRU0"="203.0.113.42"
; Pin bitmap cache to 32 MB (default varies by client build)
[HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client]
"BitmapCacheSize"=dword:00000020Saved Sessions, .rdp Files, and Credential Storage
Use “Save As” on the General tab to write an .rdp file — it is plain INI text and can be version-controlled or generated by script. Two keys are worth knowing: authentication level:i:2 forces the client to refuse a server whose certificate it cannot verify (the practical choice for a public VPS with a self-signed RDP cert is i:0, which warns but connects), and prompt for credentials:i:0 combined with username:s: pre-fills the account. Never put the password in the file; mstsc does not support that, and any tool that claims to is writing plaintext next to your session definition.
Credentials themselves are stored by Windows Credential Manager under the target TERMSRV/hostname. If an old password keeps being replayed after a server-side reset, delete the entry with cmdkey /delete:TERMSRV/203.0.113.42 and reconnect. When you need to rotate between two hosts frequently, keep two separate .rdp files rather than editing one — the MRU list at HKCU\Software\Microsoft\Terminal Server Client\Default overwrites silently and users routinely connect to the wrong server because MRU2 and MRU3 look identical in the dropdown.
CredSSP and NLA Errors: The Most Common Windows 10 Failure
The classic error is “Authentication error occurred. The function requested is not supported. Remote computer: …” with Event ID 36871 or 36874 on the server, or the client-side string “CredSSP encryption oracle remediation”. This is a version skew: the server enforces Encryption Oracle Remediation = Force Updated Clients while the Windows 10 client has not applied KB4103727 (1803) or later cumulative updates. The correct fix is to patch the client. The workaround — and it is only a workaround — is to relax the policy on the server:
# Temporarily relax on the SERVER (not a permanent setting)
$p = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters"
New-Item -Path $p -Force | Out-Null
Set-ItemProperty -Path $p -Name AllowEncryptionOracle -Type DWord -Value 2
# 0 = Force Updated Clients, 1 = Mitigated, 2 = VulnerableSet it back to 0 once the client is patched. Leaving value 2 in place re-opens CVE-2018-0886 on that host. For fleets, the same setting is under Computer Configuration > Administrative Templates > System > Credentials Delegation > Encryption Oracle Remediation.
Error Table and Exact Responses
| Client message | Underlying cause | Fix |
|---|---|---|
| “The connection was reset” or silent timeout | Nothing listening on 3389, or provider edge blocks it | Check Get-NetTCPConnection; test with Test-NetConnection host -Port 3389 from another network |
| “The Remote Desktop license server has no licenses” (0x204) | RDS role installed without CALs, or 120-day grace expired | Remove the RDS role if only admin sessions are needed, or install CALs |
| “The user name or password is incorrect” after a known-good password | Stale cached credential in Credential Manager | cmdkey /delete:TERMSRV/host |
| “The identity of the remote computer cannot be verified” | Self-signed RDP certificate | Import the host’s cert to Trusted Root, or accept once and save the .rdp file |
| Connects, then “Your session has been disconnected” within 60 s | Session limit or idle timeout policy on the server | Inspect Computer Configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Session Time Limits |
Hardening After the First Successful Login
Once the session is stable, close the surface. Network Level Authentication should be enabled (the default on Server 2019+, but verify: RDP Session Host > Security > Require user authentication for remote connections by using Network Level Authentication). Move the listener off 3389 only if your provider allows a security-group rule for the new port — otherwise you will lock yourself out on the next rebuild. Restrict source IPs at the provider edge where possible, and set an Account Lockout Policy of 5 invalid attempts with a 15-minute reset window, which stops slow password spraying without generating helpdesk noise from fat-fingered users.
If you are still choosing a host, the Windows Server plans listed on the main site include a public IPv4, a licensed Windows Server edition, and console access that survives an RDP misconfiguration — the last one is what makes a bad firewall change recoverable rather than terminal. For a wider comparison of connection methods (RD Gateway, RemoteApp, WinRM), see the connection method matrix.
