Sluggish VPN tunnels, high packet loss, or MTU size mismatches drop the secure channel negotiation midway. Step-by-Step Fixes for Error 0x904 1. Regenerate Expired RDP Certificates on the Target Host

TCP handshake on port 3389 completes successfully, but network degradation or severe packet loss drops the session right after.

If you need help implementing any of these steps, please let me know:

: Remote Desktop services rely on underlying self-signed or CA-signed SSL/TLS certificates to encrypt the pipeline. If the server's certificate expires or loses its private key binding, the client immediately drops the connection.

Ensure your client software can handle the security protocols of the host.

Windows Defender or third-party antivirus software (like Bitdefender) blocking mstsc.exe or RDP traffic.

Right-click the Start button and select or Command Prompt (Admin) . Execute the following commands one by one:

If you've tried all of these steps and the error persists, the issue may be more specific and requires a different approach.

The absolute most frequent fix for this error on standalone hosts and Windows Servers is renewing an expired self-signed RDP certificate. When expired, the Remote Desktop service ( TermService ) cannot establish a secure TLS handshake.

Navigate to: Computer Configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Security

: If you are connecting over a VPN, a "dodgy" or slow connection often triggers this specific code. Try disconnecting and reconnecting the VPN before attempting the RDP session again. Additional Troubleshooting

If you are connecting to a corporate network, the RD Gateway is the most likely culprit. Open the window. Click Show Options and navigate to the Advanced tab. Click Settings under "Connect from anywhere."

Windows will automatically generate a new, valid self-signed certificate.

This reduces security and should only be used as a last resort for compatibility with older, fully patched systems and disabled once the connection is established.

This error usually appears with a message saying, with the following details:

Rename-Item -Path "C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys" -NewName "MachineKeys_old" Use code with caution.