RDP: The disconnect reason is 4408

Question

I'm trying to get RDP using an AzureAD profile for our company and have been struggling. While I got it working well on a Windows 11 laptop, I cannot get it to work on a Windows 10 laptop. I've set them up exactly the same way and am using the exact same settings in the RDP file, but every time I go to connect, RDP fails with error "An internal error has occurred"

When I dig into the Event Viewer logs, I see Event ID 139 which states: "The server security layer detected an error (0x80090304) in the protocol stream and the client (Client IP: XXX.XXX.XXX.XXX) has been disconnected". This is followed by Event ID 103 which states: "The disconnect reason is 4408". I can't seem to find anywhere online what disconnect reason 4408 maps to, but the previous message possibly indicates a certificate issue. I deleted the RDP certificate and rebooted my PC multiple time to no avail. I don't see anything different between the certificate on the machine that is working and the one that isn't, but maybe something else is going on with the different versions of windows. Anyone aware of this error code? It's frustrating not being able to see what the error codes mean... Thanks, Alex

Answer 1

Hello Thank you for your question and reaching out.

1. Disable any Antivirus program or Windows firewall you may have for temporary purpose.
2. Please Right click this PC, click properties, Remote Desktop Settings, Allow external connections to this computer.
3. Check port 3389 enabled
4. Click on ‘RDPSettings’ and then click on Run and please wait for some time until the output comes on the right side of your monitor screen. Accordingly, repeat the same steps separately for ‘ResetRDPCert’ as well as ‘SetRDPPort’. --If the reply is helpful, please Upvote and Accept as answer--

Answer 2

I have the same issue and share your frustration at the lack of documentation for this (and other) reason codes. We continue to see drops with this reason intermittently at our organisation. Past attempts:

• https://learn.microsoft.com/en-us/answers/questions/1161777/remote-desktop-disconnects-undocumented-reason-cod
• https://learn.microsoft.com/en-us/answers/questions/713150/undocumented-disconnect-code-4408-meaning

I was hoping this support channel might be able to grab the attention of someone who could examine the source internally at Microsoft and provide some documentation for the 4xxx disconnect reason. But so far all I have recieved is generic, unhelpful replies -- a shame. If you do make any progress on this please come back and update the answer.

Answer 3

Hey All! I am not sure if you are suffering from this topic, but I think I found some lead - I am about to confirm if I was right next week.

I have 20+ devices joined to Entra ID, but one of them is producing the symptoms discussed in this thread. The only difference I could spot was that the impacted device has TPM 1.2! According to the official documentation (https://learn.microsoft.com/en-us/entra/identity/devices/device-join-plan) even Entra ID join is not supported when using certain TPM (FIPS compliant 1.2). Will come back with the results once I checked what happens if I disable it.

How about TPM chips in your cases?

Milan