Windows Server / DNS, DHCP & Server Networking
Check whether the intended Windows RDP endpoint is listening
A running server can reject Remote Desktop because its listener, service or access path is wrong. Inspect the local socket before altering firewall policy.
Environment and inputs: Windows Server 2022 / 2025 baseline · Windows PowerShell with the specified role or RSAT modules; native utilities are identified in the text. Use delegated administration and elevation only where required.
Start with this check
Confirm the host, shell and access role. Replace sample names, paths, domains and interfaces with approved targets. These are diagnostic commands; assess policy and workload impact before making changes.
Get-NetTCPConnection -State Listen -LocalPort 3389Read the result
In PowerShell on a server using the standard RDP port, this reports a local TCP listener if one exists. Alternate ports and gateways require different checks.
Resolve and verify
Compare the socket and service state with the approved RDP design, then test through the required gateway or private network. Review the actual sign-in error separately.
Before changing production
Do not expose RDP publicly or assume an open socket proves user authorization and Network Level Authentication work.