W11 24H2 Domain Joined - Can't 'connect' to external RDP Gateways

[Planehazza]

Bit of an odd one that has been stressing me for days. Just wondering if anyone has had this?

 

The issue

Connecting to internal devices via RDP, works perfectly fine.  Connecting to RDP gateways for Iris Financials or the LA's payroll systems etc, work fine on W10. Windows 11 Pro Education, no joy. It prompts for credentials, accepts them if they're valid, but then sticks on 'Initiating remote connection...'. Clicking on details when it times out, I see Error 0x204 It also shows the timestamp in UTC and American date format, so it's an hour behind our GMT+1 I doubt this is anything of note though, as it works with w10 devices.

 

Troubleshooting thus far

We don't use a captured imaged, just a wim that I've injected some files into and stripped various AppX packages like Solitaire, Xbox etc. However, I have ruled this out as the cause by replacing the wim with the bog standard, untouched W11 24h2 install.wim.

 

We use Lightspeed but I've made a test SCCM task sequence that doesn't deploy them, so ruled that out also. 

 

Windows firewall has been disabled entirely, no joy.

 

Since discovered that the same TS works for these gateways only if the client never sees our domain, ie workgroup. This screams a bad GPO somewhere, but I've got the clients joining a root level OU that is isolated from all GPOs. If it domain joins, then put into a workgroup and rebooted, it still fails, so it seems that joining our domain is breaking something and removing it from the domain is not enough to revert whatever this is.

 

I've tried various suggested reg keys from googling but no avail

 

I can't see any obvious event logs, but if someone with more RDP experience than I can tell me precisely which logs to look at that would be a great help

 

 

 

Desperate for help if anyone has any ideas.

 

Thanks!

 

Edited July 17, 2025 by Planehazza

[Planehazza]

using netstat -a I can see connections when using mstsc to a local server, but I see absolutely nothing against port 3389 when attempting to reach external RDP gateways 

[Planehazza]

Could it be an NTLM issue? I'm reading lots of issues with 24H2 in general, but it's possibly compounded by the fact we still (sigh) have several DCs on server 2016 and so our domain functional level is still at 2016.

 

I'm going to try W11 23H2 and report back

[Olliedawg]

7 minutes ago, Planehazza said:

Could it be an NTLM issue? I'm reading lots of issues with 24H2 in general, but it's possibly compounded by the fact we still (sigh) have several DCs on server 2016 and so our domain functional level is still at 2016.

 

I'm going to try W11 23H2 and report back

I thought 2016 was the maxiumum functional level?

[Planehazza]

34 minutes ago, Olliedawg said:

I thought 2016 was the maxiumum functional level?

Just checked, and yep, you're correct 

[Planehazza]

23H2 doesn't work and RSOP confirms no policies applied. Something, when domain joining is preventing RDG. 

 

Potentially a stupid question, but what else at domain join could affect this with GPOs out of the equation?

[Olliedawg]

I'm not an expert with RDP, but I do know that 24H2 introduced a lot of changes. One of which being that NTLMv1 is restricted/blocked by default, RDP now uses Kerberos. I think it's supposed to fallback to NTLM if Kerberos fails, so this may be part of your issue?

 

I cant offer any more help than that I'm afraid if you've already combed through group policies

[Planehazza]

3 minutes ago, Olliedawg said:

I'm not an expert with RDP, but I do know that 24H2 introduced a lot of changes. One of which being that NTLMv1 is restricted/blocked by default, RDP now uses Kerberos. I think it's supposed to fallback to NTLM if Kerberos fails, so this may be part of your issue?

 

I cant offer any more help than that I'm afraid if you've already combed through group policies

Yep, NTLM is something I've been looking at too, but I can't see why this would work on clients that have never seen the domain, even when no GPOs have applied.

 

I've looked at this and set the value to 3, to no avail:

 

https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-security-lan-manager-authentication-level

[Planehazza]

After many hours (basically a whole work week) of trialling, troubleshooting, it seems that SCCM client is at fault. I went through the steps of the SCCM TS manually, installing OS, updates, apps etc one by one manually with two reboots between each step and and it worked until SCCM agent went on. I now suspect that either client settings are corrupting something, or the agent files aren't updating. This would explain why Windows 10 PCs were working fine, and W11 were't. I put an affected PC back to W10 and the problem started happening there, so it seems like a recent SCCM update has tweaked or broken something...

[Planehazza]

Yep, so it's definitely the SCCM agent at fault. If I run a TS that does not install the SCCM client I can connect to external RDGs just fine. If I install it manually from the SCCM CCM share, it starts failing, and subsequently removing it does not restore functionality. This makes me suspect client settings but I cannot see anything that would affect it.

 

Does SCCM client enforce anything TLS or NTLM etc wise that could be causing this headache?

[psydii]

seems like a perfect time to try out this trick for comparing the registry before and after a change:

 

Microsoft PowerShell lets you track Windows Registry changes

 

First run on the working PC, then deploy the sccm client and run it again. then do the diff.

[Planehazza]

Update... I hate these kind of topics. Turns out it's the Lightspeed agent filter and that in my mind fog of staring at this problem for so long I overlooked something embarrassingly simple... if you don't install the CCM client on the PCs duing the TS, then subsequent deployed apps do not install either. I started installing these manually, testing as I went and once I'd installed Lightspeed client, bam, broken. No idea why it has suddenly become a conflict, regardless of version. 

 

Support ticket in with lightspeed in the mean time... 🤦🤦

[Planehazza]

SSL decryption. No need to say anymore 🤦

[MMerry]

Hi,

 

I seem to have the same issue. What did you do to enable this,

[Davit2005]

I'd certainly go looking at ntlm settings. I don't know where they are but I know we had issue here, I'm not a desktop support role but I got involved as in networking team we get called in for nearly everything not working, lol.