No longer able to RDP into Windows 11 desktop after connecting via Watchguard SSL VPN

Question

I have two users who are no longer able to use Remote Desktop to connect to their Windows 11 25H2 desktops after connecting using Watchguard Mobile VPN with SSL client. I worked with Watchguard support, but the issue is only with RDP into desktops not the VPN itself. I am still able to RDP into the server without issue. I am also able to RDP to the computers within the corporate network, but not after connecting to the VPN. I was told that Microsoft is discontinuing RDP and migrating to the Windows App, however, after downloading and installing it, that doesn't seem an option at this time.

Answer 1

1. Verify basic connectivity over the VPN

Run the following PowerShell commands while connected to the VPN:

Test-NetConnection <PCName> -Port 3389

Test-NetConnection <IPAddress> -Port 3389

I tried this both from the VPN and from the local network. From the VPN it fails both ways, from the local network it works.

2. Test using both hostname and IP address

• If one method works and the other does not, the issue may be related to DNS resolution over the VPN.
• RDP authentication can behave differently when connecting by IP address versus FQDN, especially when Network Level Authentication (NLA) is involved.

NLA is disabled completely.

3. Review Network Level Authentication (NLA)

• Windows 11 enables NLA by default.
• If the remote computer cannot validate credentials correctly when accessed through the VPN, the RDP session may fail before the desktop is presented.
• As a troubleshooting step, you may temporarily disable NLA to determine whether authentication is contributing to the issue.

Again NLA is disabled completely.

4. Verify Windows Firewall and security settings

• Confirm that the Remote Desktop firewall rules are enabled on the affected Windows 11 devices.
• Ensure that VPN client subnets are not being blocked by local firewall policies or third-party security software.

I have verified that the firewall rules are correct and as additional testing I disabled the firewall and tried as well as trying it with the firewall and antivirus disabled. Still not able to connect through RDP via VPN.

5. Review Event Viewer logs on the affected PCs

Please check the following logs for authentication or connectivity-related events:

• Applications and Services Logs → Microsoft → Windows → TerminalServices
• Applications and Services Logs → Microsoft → Windows → RemoteDesktopServices
• Windows Logs → System
• Windows Logs → Security

Nothing really showed up in the logs, however, I installed Wireshark and have packet captures showing the RDP traffic being sent to the client machine, but the machine never responds.

6. Review WatchGuard VPN routing and policies

Because RDP to servers works while RDP to Windows 11 workstations does not, it would be worthwhile to verify that:

• The workstation subnets are included in the VPN routes.
• No VPN policy is filtering RDP traffic to client operating systems.
• VPN clients receive the correct DNS servers and DNS suffixes.
• There have been no recent WatchGuard policy changes affecting workstation traffic.

I worked with Watchguard support and have confirmed that the traffic is passing through the firewall, but the Windows 11 computer does not respond.

Answer 2

Welcome to Microsoft Q&A!

Thank you for providing the detailed information.

First, I would like to clarify that Remote Desktop Protocol (RDP) has not been discontinued in Windows. Windows 11 Pro and Enterprise continue to support Remote Desktop connections, and Microsoft is still releasing updates and fixes for RDP-related functionality. What Microsoft has deprecated is the Remote Desktop app from the Microsoft Store, which has been replaced by Windows App for accessing cloud services such as Azure Virtual Desktop, Windows 365, and Microsoft Dev Box. Traditional RDP connections to Windows PCs remain fully supported.

Reference: Remote Desktop client - supported configuration | Microsoft Learn

Based on your description, the issue appears to be related to authentication or network connectivity over the VPN rather than any deprecation of Remote Desktop itself. Given that:

• RDP to servers works successfully through the VPN.
• RDP to the affected Windows 11 devices works from within the corporate network.
• The issue only occurs when connecting through the WatchGuard SSL VPN.

This suggests that the problem is likely related to how VPN traffic reaches or authenticates to the Windows 11 devices, rather than an issue with the VPN tunnel itself.

I recommend checking the following:

1. Verify basic connectivity over the VPN

Run the following PowerShell commands while connected to the VPN:

Test-NetConnection <PCName> -Port 3389

Test-NetConnection <IPAddress> -Port 3389

This will confirm whether TCP port 3389 is reachable through the VPN. Verifying port connectivity is an important first step when troubleshooting RDP connectivity issues.

2. Test using both hostname and IP address

• If one method works and the other does not, the issue may be related to DNS resolution over the VPN.
• RDP authentication can behave differently when connecting by IP address versus FQDN, especially when Network Level Authentication (NLA) is involved.

3. Review Network Level Authentication (NLA)

• Windows 11 enables NLA by default.
• If the remote computer cannot validate credentials correctly when accessed through the VPN, the RDP session may fail before the desktop is presented.
• As a troubleshooting step, you may temporarily disable NLA to determine whether authentication is contributing to the issue.

4. Verify Windows Firewall and security settings

• Confirm that the Remote Desktop firewall rules are enabled on the affected Windows 11 devices.
• Ensure that VPN client subnets are not being blocked by local firewall policies or third-party security software.

5. Review Event Viewer logs on the affected PCs

Please check the following logs for authentication or connectivity-related events:

• Applications and Services Logs → Microsoft → Windows → TerminalServices
• Applications and Services Logs → Microsoft → Windows → RemoteDesktopServices
• Windows Logs → System
• Windows Logs → Security

These logs often provide the exact reason for the connection failure.

6. Review WatchGuard VPN routing and policies

Because RDP to servers works while RDP to Windows 11 workstations does not, it would be worthwhile to verify that:

• The workstation subnets are included in the VPN routes.
• No VPN policy is filtering RDP traffic to client operating systems.
• VPN clients receive the correct DNS servers and DNS suffixes.
• There have been no recent WatchGuard policy changes affecting workstation traffic.  

For additional information, please refer to:

February 11, 2025—KB5051987 (OS Build 26100.3194) | Microsoft Support

Accessing Cloud PCs | Microsoft Learn

I hope this information helps. If you find the answer helpful, please click Accept Answer and consider giving it an upvote.

Thank you for posting your question in Microsoft Q&A.