Remote Desktop Connection Error Code 0x904 Install | I

When attempting to install an update, patch, or feature related to Remote Desktop Connection (mstsc.exe) or when an RDP session initialization triggers an automatic component installation, the system returns:

The 0x904 error can occur if the Credential Manager contains a corrupted entry for the target remote computer.

Steps:

Error 0x904 is not a hardware failure or a simple mistyped IP address. It is a security dialect barrier. The “install” event that preceded it—whether a Windows update, a new RDP client version, or an RDS role deployment—changed the language of the negotiation table. One side now speaks only modern, patched CredSSP; the other clings to legacy encryption. By harmonizing the CredSSP settings or aligning licensing states, an administrator can silence the ghost of 0x904 and restore the remote session. In the end, this error serves as a reminder: in remote connectivity, compatibility is not a feature—it is a constantly negotiated treaty.

Error code 0x904 in Remote Desktop Connection (RDP) typically signals that a connection could not be established due to expired or corrupt security certificates network instability firewall blocks

. While it often mimics a general "can't connect" message, 0x904 is frequently linked to a specific failure in the encryption handshake between the client and server. Core Causes of Error 0x904 Expired Self-Signed Certificates:

The server's RDP certificate has expired and failed to renew automatically. Certificate Store Corruption: Common on Azure VMs, where the MachineKeys

folder becomes corrupt, preventing new certificate generation. Network Instability:

Insufficient bandwidth, high packet loss, or slow VPN connections. TLS/Cipher Mismatches:

Windows 11 clients may fail to connect to older servers if TLS 1.2 is not enabled or if encryption suites do not match. Step-by-Step Troubleshooting Guide 1. Renew Expired RDP Certificates

This is the most common fix for 0x904 when only specific servers are affected.

Log into the affected server locally or via an alternative remote tool. certlm.msc

, and hit Enter to open the Certificate Manager for the local machine. Navigate to Remote Desktop > Certificates (or Personal > Certificates). Identify the Remote Desktop certificate , check its expiration date, and if it has expired. Open an elevated Command Prompt and run: restart-service termserv -force

Windows will automatically generate a fresh self-signed certificate upon service restart. 2. Fix Certificate Store Corruption (Azure & Local) i remote desktop connection error code 0x904 install

If Windows cannot create a new certificate, you may need to clear the certificate key store. For Azure VMs: Use the "Run Command" feature in the Azure Portal. For Local Servers: Run PowerShell as an Administrator. Execute the following command to rename the key folder:

Rename-Item -path "C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys" -NewName "MachineKeys_old" Reboot the server. Windows will recreate the folder and repair the store. 3. Bypass DNS with IP Address (Windows 11 Fix)

Windows 11 builds (22H2 and later) sometimes have hostname resolution bugs that trigger 0x904. In the Remote Desktop Connection window, enter the IP address of the target machine (e.g., 192.168.1.50 ) instead of the computer name. Alternatively, use the Microsoft Store Remote Desktop app

, which uses a different network stack and often bypasses this specific bug. 4. Adjust Firewall and Network Profiles Allow WebSocket: Ensure both Remote Desktop Remote Desktop (WebSocket)

are allowed through the Windows Firewall for both Private and Public profiles. Switch Profile: If your network is set to "Public," change it to in Windows Settings to allow RDP traffic more easily. Test the Port:

Use PowerShell to verify the RDP port (3389) is actually reachable: Test-NetConnection [ServerIP] -Port 3389 5. Disable Network Level Authentication (NLA) for Testing

If encryption mismatches persist, you can temporarily lower the security requirement to verify the connection. Group Policy Editor gpedit.msc

Computer Configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Security

"Require use of specific security layer for remote (RDP) connections" and select as the layer.

"Require user authentication for remote connections by using Network Level Authentication". Restart the machine.

Did the 0x904 error appear immediately after a Windows Update, or has the server been unreachable for an extended period? Fix Remote Desktop Error Code 0x904: 4 Working Solutions 10 Dec 2025 —

Here’s a short, interesting blog post draft based on that search query. It’s written in a helpful, slightly conversational tech-blog style.

Title: Error 0x904 Won’t Let You RDP? Here’s the “Install” Fix Nobody Talks About When attempting to install an update, patch, or

Published: April 12, 2026

You’re trying to remote into your work PC. You type in the IP, enter your credentials, and then — boom. A dialog box that makes your eye twitch:

Remote Desktop Connection – Error code 0x904

You Google it. Most results scream “licensing issue!” or “SSL cert problem!” But buried in a forgotten Microsoft forum thread, one user casually mentions the word “install” — and that’s the real clue.

Here’s what’s actually happening:

Error 0x904 isn’t just a generic “can’t connect.” It usually means the Remote Desktop Session Host configuration on the target machine is missing a required role service or is stuck in a “listening but not accepting” state.

The “install” fix that works (when rebooting fails):

But wait — what if that role is installed?

Then the issue is likely a corrupted RDP listener. Uninstall and reinstall the RDP listener component:

reg delete "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /f
net stop TermService
net start TermService

Why this blog post is interesting:

Because 90% of the “fixes” online tell you to check firewalls, enable RDP in System Properties, or mess with Group Policy. They ignore the fact that sometimes the underlying Windows feature just… didn’t install right during an update or sysprep.

So next time you see error 0x904, don’t just check settings — check what’s actually installed.

Have you seen 0x904 before? Drop your weirdest RDP error in the comments. Title: Error 0x904 Won’t Let You RDP

Remote Desktop error code is often described by IT professionals as a "

silent ghost" error because it frequently appears on servers that have worked perfectly for months, only to suddenly block access without any prior warning or obvious configuration change www.remoteaccesspcdesktop.com The "Silent" Root Causes

Experts and system administrators have identified that this specific error rarely stems from a single setting but is usually triggered by one of the following "invisible" issues: Expired RDP Certificates

: This is the most common culprit discovered by admins in troubleshooting communities. Windows creates self-signed certificates for Remote Desktop that do not always renew automatically. When they expire, the connection fails with 0x904. Network Instability

: Unlike other codes that signal a complete block, 0x904 often points to "dodgy" or unstable network paths, such as insufficient VPN bandwidth, packet loss, or mismatched encryption ciphers. Windows 11 Compatibility Quirks

: In builds 22H2 and later, some users found that hostname resolution specifically for RDP is buggy, causing 0x904 unless an IP address is used instead. www.remoteaccesspcdesktop.com Top Recommended "Reviewer" Fixes Based on successful documentation from IT forums like Microsoft Q&A , these are the most effective solutions: Renew the Self-Signed Certificate certlm.msc on the host machine. Navigate to Remote Desktop > Certificates Delete the expired certificate and restart the Remote Desktop Services (TermService) to force Windows to generate a fresh one. Bypass DNS with IP Addresses

: If you are on Windows 11, try connecting using the remote machine's internal IP address (e.g., 192.168.1.50) rather than its computer name. Switch to the Microsoft Store App : Many professionals recommend using the Microsoft Remote Desktop app from the Store rather than the built-in

, as the Store version uses a more resilient networking stack that often bypasses the 0x904 error. The Azure "MachineKeys" Fix

: For Azure Virtual Machines, 0x904 is often caused by a corrupt certificate store. Admins have fixed this by renaming the C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys MachineKeys_old and rebooting the server. www.remoteaccesspcdesktop.com Are you attempting to connect to a local workstation cloud-hosted server like Azure?

Because mstsc.exe runs as a child process of explorer.exe, a buggy shell extension can cause the RDP client to fail with code 0x904. The primary culprits are NVIDIA Display Container LS and Intel Graphics Shell Extension.

Temporary fix (to test):

Permanent fix: Use Autoruns from Microsoft Sysinternals to disable all non-Microsoft shell extensions.