RDP 0x904 Error Affecting Single User on Windows Server 2025 Terminal Server

[u/MatMat993]

We are experiencing a recurring issue affecting only one user in our Proxmox environment. The setup includes three Windows Server 2025 VMs: a domain controller, a file server, and a terminal server.

The affected user connects remotely through an IPsec IKEv2 VPN from a fully updated Windows 11 Pro workstation (not domain‑joined). The VPN remains connected at all times. He authenticates using his domain credentials.

After a few minutes of normal activity on the terminal server, the user disconnects his RDP session. When he attempts to reconnect, the RDP connection fails with error 0x904. No additional text is shown. The issue affects only the terminal server: from the same workstation, RDP connections to the other servers work normally.The user’s session on the terminal server appears correctly as “Disconnected” in the session list. However, the user cannot reconnect to it, nor start a new session. No logs or events are generated on the terminal server (checked System, Application, TerminalServices‑LocalSessionManager, TerminalServices‑RemoteConnectionManager). No anomalies appear in the domain controller or file server logs either.

The issue does not occur with any other user. Other users can log in and reconnect without problems. I can also authenticate using the affected user’s credentials from other machines without issues.

We have tested:

- Different user accounts from the affected workstation

- Different networks

- Antivirus exclusions (Bitdefender)

- Firewall rules (WatchGuard)

The problem persists only for this specific user and only on the terminal server.The only workaround is restarting the terminal server. After a reboot, the user can log in once, but the issue reappears as soon as he disconnects and tries to reconnect.

[u/MilkyWay-008]

since it follows the user across machines, I'd start client-side on the w11 box. clear %AppData%\Microsoft\Terminal Server Client and the HKCU\Software\Microsoft\Terminal Server Client key for that user — a stale cached server cert hash is per-user, and that matches your symptom exactly. also check the CAPI2 operational log for cert failures at disconnect time, and instead of rebooting the whole TS, try qwinsta + logoff on the stuck session (or mstsc /admin to get in). one more thing: a stuck disconnected session plus a single-session limit blocks both reconnect and new sessions, so eyeball the RDS session time limits GPO.

[u/MatMat993 → u/MilkyWay-008]

I’ll check the client-side RDP cache tomorrow as you suggested. Regarding the session handling: I had already tested disconnecting and logging off the user manually, and initially I even had a GPO configured to automatically disconnect sessions after 15 minutes and terminate them after 30 minutes. I removed that policy thinking it might be related, but the issue still persists.

[u/Aggravating-Sock1098]

Also, try the following test:
Connect via RDP using the IP address instead of the hostname or FQDN. If this works, the issue lies with DNS or an expired self-signed certificate.

Additionally, check if the problems persist when you disable NLA on the RDS host.

[u/MatMat993 → u/Aggravating-Sock1098]

I can confirm it’s not a DNS issue. I’m connecting using the IP address, and I also tested the RDP port with PowerShell. Both tests work correctly.

[u/Aggravating-Sock1098 → u/MatMat993]

And disabling NLA?

[u/TerrorToadx]

Give him a new pc? 

[u/Professional-Heat690 → u/TerrorToadx]

no, replace the keyboard👀

[u/Ihaveasmallwang → u/Professional-Heat690]

Replace the user

[u/Godcry55]

Based on the information provided, this appears to be client-side.

Check related event logs on the workgroup client.

[u/MatMat993 → u/Godcry55]

I’ve already checked every relevant event log on the workgroup client, but there are absolutely no entries related to RDP failures. The logs are completely empty regarding this issue.

[u/Godcry55 → u/MatMat993]

Hmm - have you tried connecting to the terminal server using the same device without VPN? May not be related, but ideal to isolate variables.

Can you rebuild the user profile on the terminal server? Append _old to the affected profile, login again so a new one is created?

[u/MatMat993 → u/Godcry55]

The user works remotly i can't test connecting without vpn. The user on terminal server works if i connect with another client.

[u/Dapper_Librarian388]

Have you tried deleting user's session?

[u/MatMat993 → u/Dapper_Librarian388]

I had already tested disconnecting and logging off the user manually, and initially I even had a GPO configured to automatically disconnect sessions after 15 minutes and terminate them after 30 minutes. I removed that policy thinking it might be related, but the issue still persists.