Windows · Windows Server · high · Networking & connectivity

Remote Desktop: "an internal error has occurred" — 0x204, 0x1104, 0x3

A group of RDP failures with an unhelpful shared message. The hex code after it is the part that matters.

What you see

The client shows "An internal error has occurred" and closes. Sometimes it connects and drops immediately, sometimes it never reaches the credentials prompt.

What is actually wrong

0x204 is usually the firewall or the service not listening. 0x1104 and 0x904 are commonly a licensing or protocol negotiation problem. A CredSSP encryption oracle mismatch is its own error and is caused by one end being patched and the other not.

Codes and articles

0x2040x11040x9040x108internal error has occurredCredSSP0x80090326KB4093492

Fixes (3)

Confirm something is listening and reachable on 3389

Elevated PowerShell on the target machine15 minuteslow riskreversible

It fails instantly. Establish the basics before touching protocol settings.

Check RDP is enabled and the service is up.

PowerShell

Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnectionsGet-Service TermService,UmRdpService | Format-Table Name,Status,StartType

Check what port it is on — a previous change or a conflicting application moves it.

PowerShell

Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name PortNumberGet-NetTCPConnection -State Listen -LocalPort 3389

Check the firewall rules are enabled for the profile the machine is actually on.
PowerShell
```
Get-NetConnectionProfile | Format-Table Name,NetworkCategoryGet-NetFirewallRule -DisplayGroup 'Remote Desktop' | Format-Table DisplayName,Enabled,Profile
```
A machine that has flipped to the Public profile after a network change has the rules in place but not applied to it, which produces exactly this error with nothing logged.

Enable it properly if it is off.

PowerShell

Set-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections -Value 0Enable-NetFirewallRule -DisplayGroup 'Remote Desktop'

Confirm it workedThe port answers from the client machine.

PowerShell

Test-NetConnection target -Port 3389 -InformationLevel Detailed

If you need to undo itSet fDenyTSConnections back to 1 and Disable-NetFirewallRule for the group.

Resolve the CredSSP encryption oracle mismatch at the right end

Elevated PowerShell20 minuteshigh riskreversible

The error names CredSSP or an encryption oracle remediation, usually 0x80090326.

Identify which end is unpatched. The correct fix is always to patch the server, not to weaken the client.
PowerShell
```
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 10 HotFixID,InstalledOn
```
Bring the remote machine up to date. This removes the mismatch permanently and is the only fix that does not reduce security.
If the remote machine genuinely cannot be patched right now and access is needed to do so, the client can be relaxed temporarily.
PowerShell
```
New-Item -Path 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters' -Force | Out-NullSet-ItemProperty 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters' -Name AllowEncryptionOracle -Type DWord -Value 2
```
Value 2 is Vulnerable — it permits a downgraded session that an attacker on the path can exploit. It exists to get you in to patch the far end, and should be reverted the moment you have.

Revert as soon as the server is patched.

PowerShell

Remove-ItemProperty 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters' -Name AllowEncryptionOracle

Confirm it workedWith both ends patched and the client value removed, the session connects normally.

If you need to undo itRemove the AllowEncryptionOracle value, as shown in the last step.

Turn off the protocol features that fail on the far end

Elevated PowerShell on the target15 minuteslow riskreversible

It connects, shows black, then drops — usually a graphics or bitmap negotiation problem.

Read the client-side reason from the log.

PowerShell

Get-WinEvent -LogName 'Microsoft-Windows-TerminalServices-RDPClient/Operational' -MaxEvents 30 | Format-Table TimeCreated,Id,Message -Wrap

Disable UDP transport on the client, which is the usual cause of a session that connects and dies on a lossy link.
PowerShell
```
New-Item 'HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\Client' -Force | Out-NullSet-ItemProperty 'HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\Client' -Name fClientDisableUDP -Type DWord -Value 1
```
RDP starts on TCP and upgrades to UDP for responsiveness. When UDP is partly blocked the upgrade succeeds and then stalls, which looks like a black screen rather than a network fault.
On the target, restart the service outside working hours — it disconnects everyone.
PowerShell
```
Restart-Service TermService -Force
```
If the target is a VM with a GPU-accelerated encoder, disable hardware encoding for RemoteFX in Group Policy under Remote Session Environment.

Confirm it workedA full session opens and stays up for several minutes with a screen refresh.

If you need to undo itRemove fClientDisableUDP to restore UDP transport.

Where this stops. This write-up was written and checked by hand. It says what each step changes, how to confirm it worked and how to reverse it, and anything destructive is flagged before you reach it. If it does not match what your machine is doing, search the Support Centre for the exact code or message — and when something needs a person, get in touch.