VM not allowing logins after making some system changes to encryption ciphers.

Question

I have 2019 Windows Server DC VM that is running but get a logon failed error message from the RDP client or Connection Error via Bastion. I've tried rebooting, redeploy and all the other suggestion provided by the Azure wizards. Is there any other way to access the VM? Can I boot it up in safe mode and access it via Bastion? I know the RDP connection is good as I've been using it for a while. I was disabling some outdated TLS protocols and weak Cipher, and had rebooted a couple of times checking the status of changes. I'm guessing the last Cipher I removed must have caused this, it never dawned on me that this would happen. But I'm just guessing but it was the last thing I did before the reboot.

Answer 1

Hi Dre2k,

If you suspect that the recent changes to the TLS protocols and ciphers are the cause of the RDP issue, you might be right. Disabling certain ciphers and protocols could make the RDP service unavailable if it was relying on them.

Here are the steps you can take to rectify the situation:

• Serial Console Access: Azure provides a serial console access for VMs. This might allow you to get a command-line interface to the VM and potentially revert the changes.
• Restore Previous Disk Snapshot: If you have a disk snapshot before the change, you can restore your VM using that snapshot.
• Attach Disk to Another VM:
• Stop the problematic VM.
• Detach the OS disk from the VM.
• Create a new VM or use an existing one.
• Attach the OS disk from the problematic VM as a data disk to this new/existing VM.
• Once the disk is attached, you should be able to navigate to the file system and make necessary changes or retrieve data.
• After making the changes, detach the disk from this VM and reattach it back to the original VM, then try starting it.
• Safe Mode: Booting into Safe Mode might help. However, by default, you can't boot an Azure VM into Safe Mode via RDP or Bastion since you don't have access to the boot process. But once you've attached the OS disk to another VM (as in step 3), you can modify the boot configuration:
• Navigate to the attached OS disk and locate the boot configuration data (usually located in the root and named BCD).
• Use the bcdedit tool to set the boot mode to Safe Mode. This involves setting the {current} boot entry to Safe Mode.
• Reattach the disk back to the original VM and start it. It should boot in Safe Mode.
• Azure Backup: If you've set up Azure Backup for your VM, you can restore your VM to a point before the changes were made.
• Azure Support: If all else fails, consider reaching out to Azure support. They might have additional tools or methods to assist in such situations. For the future, consider always testing configuration changes in a staging or test environment before applying them to your main server. This way, you can catch potential issues before they affect your production environment.

I hope this helps with your query?