[a solution] "Internal server error" when connecting to a Windows server over RDP. Error 0x8009030D in Windows System log

Question

It took me a couple of hours to resolve this sudden issue, so I'm placing the solution here. The error appeared after changing an expired server SSL certificate with a new one.

== Symptoms

 

Impossible to RDP to a server. Error message appears immediately after the connection is initiated: "Internal server error".

 

Error messages with code 36870 from Schannel appear in System log after the failed connection attempt:

 

A fatal error occurred when attempting to access the TLS server credential private key. The error code returned from the cryptographic module is 0x8009030D. The internal error state is 10001.

 

== The root cause

 

SYSTEM has lost access to a file with the private key under C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys. An example of such a key:

 

C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_6885a9e6-2e13-4b1d-9b44-6ff242ad1751

 

== Resolution

 

Use Procmon to identify the file accessed by svchost under that folder. Take ownership of the file and assign Full Control right to SYSTEM. Restart the server.

Answer 1

(see above)

Answer 2

Hi @Evgeny Lotosh

Thank you for sharing this information in our forum.

I will copy past the root cause and the solution here to be able to accept it and help forum visitors facing the same issue to identify the root cause and the solution:

== The root cause

 

SYSTEM has lost access to a file with the private key under C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys. An example of such a key:

 

C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_6885a9e6-2e13-4b1d-9b44-6ff242ad1751

 

== Resolution

 

Use Procmon to identify the file accessed by svchost under that folder. Take ownership of the file and assign Full Control right to SYSTEM. Restart the server.