A new certificate will be automatically generated upon the next connection attempt. 2. Fix MachineKeys Corruption (Azure VMs)
The RDP listener uses a certificate from the Remote Desktop store. If the certificate is expired, self-signed without trusted chain, or uses unsupported key length (<2048 bits), the TLS handshake fails, returning 0x904 on the client.
In hardened environments (like those using CyberArk PSM ), the NETWORK SERVICE account may lose access to the certificate's private key.
If your network is unstable, RDP’s attempt to use UDP for performance can lead to crashes. Unable to RDP into some Windows Servers - Error code: 0x904
RDP supports three security layers:
Follow these troubleshooting steps in order of most common effective fixes. 1. Reset the Remote Desktop Certificate
This forces the VM to rebuild its cryptographic storage and generate a fresh RDP listener certificate. 3. Grant Private Key Permissions