Last Updated: March 2026

One of the most frustrating problems when managing infrastructure in Microsoft Azure is when a Virtual Machine responds to ping but Remote Desktop (RDP) connections fail.

At first glance, this situation can be confusing. If the VM responds to ping, it means:

• The VM is powered on
• Network connectivity exists
• Routing is functioning
• The public IP address is reachable

Yet RDP still refuses to connect.

Over the years working with Azure infrastructure, I’ve seen this exact issue appear during:

• VM migrations
• Network security changes
• Firewall updates
• NSG misconfigurations
• Windows updates

In most cases, the problem comes down to security rules, firewall policies, or RDP service issues inside the VM.

The key is diagnosing the issue systematically, starting from the Azure network layer and working down to the operating system.

In this guide, I’ll walk through the real-world troubleshooting process I use to diagnose Azure VMs that respond to ping but refuse RDP connections.

Quick Fix Summary

If your Azure VM responds to ping but RDP fails, check these first:

• Ensure port 3389 is allowed in the Network Security Group (NSG).
• Confirm Windows Firewall allows Remote Desktop connections.
• Verify the RDP service is running on the VM.
• Check whether Azure Bastion or Just-In-Time VM access policies are blocking access.
• Use Azure Serial Console or Run Command to troubleshoot the VM internally.

These checks solve the majority of Azure RDP issues.

Step-by-Step Troubleshooting

1. Verify the Network Security Group (NSG) Allows RDP

Why This Is the Most Common Cause

Azure uses Network Security Groups (NSGs) to control inbound and outbound traffic.

Even if your VM responds to ping (ICMP), the NSG may still block TCP port 3389, which RDP requires.

How to Check NSG Rules

1. Go to Azure Portal
2. Navigate to your Virtual Machine
3. Select Networking
4. Review the Inbound Port Rules

You should see something like:

Port: 3389
Protocol: TCP
Action: Allow
Priority: <lower number than deny rules>

Common NSG Problems

• RDP rule missing
• Rule priority overridden by deny rule
• RDP restricted to specific IP ranges
• NSG applied at subnet level instead of VM level

Even experienced admins sometimes forget that multiple NSGs can apply simultaneously.

2. Confirm the VM’s Public IP and NIC Configuration

Sometimes RDP failures occur because the VM no longer has a public IP attached or the NIC changed.

Check:

• Public IP assigned to VM
• Correct network interface attached
• No recent network changes

Test Port Connectivity

From your local machine run:

Test-NetConnection <publicIP> -Port 3389

If the port test fails while ping succeeds, the problem is usually:

• NSG rules
• Windows firewall
• RDP service

3. Check Windows Firewall on the VM

If Azure networking is configured correctly, the next likely culprit is the Windows firewall inside the VM.

Windows Defender Firewall can block RDP even when Azure allows it.

Verify RDP Firewall Rule

Using PowerShell Run Command in Azure:

Get-NetFirewallRule -DisplayGroup "Remote Desktop"

Ensure the rule shows:

Enabled : True
Action  : Allow

Enable RDP Firewall Rules

If disabled:

Enable-NetFirewallRule -DisplayGroup "Remote Desktop"

In real-world environments, group policies sometimes disable these rules unintentionally.

4. Ensure Remote Desktop Services Are Running

Another common issue is that the Remote Desktop Services service has stopped.

This can occur after:

• Windows updates
• VM snapshots
• failed system patches

Check RDP Service

Using Azure Run Command:

Get-Service TermService

If stopped:

Start-Service TermService

Also ensure the startup type is automatic:

Set-Service -Name TermService -StartupType Automatic

5. Check RDP Configuration in Windows

RDP may also be disabled entirely in Windows settings.

Using PowerShell:

Get-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Terminal Server" -Name fDenyTSConnections

If the value is:

1

RDP is disabled.

To enable it:

Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Terminal Server" -Name fDenyTSConnections -Value 0

6. Use Azure Serial Console for Deep Troubleshooting

If all else fails, the Azure Serial Console can provide direct access to the VM.

This tool allows administrators to troubleshoot when:

• RDP fails
• networking is broken
• Windows won’t fully boot

You can use the console to:

• restart services
• repair firewall rules
• investigate logs

In many incidents I’ve handled, Serial Console access saved hours of downtime.

7. Check Azure Just-In-Time VM Access

Many organisations enable Azure Defender Just-In-Time VM access for security.

This feature keeps RDP closed until temporarily opened.

If JIT is enabled:

1. Navigate to Microsoft Defender for Cloud
2. Open Just-In-Time VM Access
3. Request RDP access

Without doing this, the NSG automatically blocks port 3389.

Additional Troubleshooting Tips

Restart the VM

This sounds obvious, but it can fix:

• networking stack issues
• service failures
• pending Windows updates

Check for Group Policy Restrictions

Domain-joined VMs may have group policies blocking RDP.

Check policies related to:

• Remote Desktop Services
• Network access
• firewall rules

Review Event Logs

Windows event logs often reveal RDP failures.

Check:

Event Viewer → Windows Logs → Security
Event Viewer → Windows Logs → System

Look for:

• failed logon attempts
• RDP service errors
• authentication failures

Real-World Experience

In my experience managing Azure infrastructure, NSG misconfiguration is responsible for around 70–80% of RDP connectivity issues.

The second most common cause is Windows firewall rules or group policy changes.

Rarely is the VM itself the problem — the issue usually lies somewhere in the Azure networking or security configuration.

The best approach is always to troubleshoot from the outside in:

1. Azure networking
2. NSG rules
3. Windows firewall
4. RDP service
5. Windows configuration

Following this order dramatically speeds up diagnosis.

FAQ

Why can I ping an Azure VM but not RDP?

Ping uses ICMP while RDP uses TCP port 3389. The network may allow ICMP but block RDP through firewall rules or NSG policies.

What port does RDP use in Azure?

Remote Desktop Protocol uses TCP port 3389 by default.

How do I test if port 3389 is open?

You can test it using PowerShell:

Test-NetConnection <IP> -Port 3389

Can Azure NSG block RDP even if Windows allows it?

Yes. NSG rules apply before traffic reaches the VM. If the NSG blocks port 3389, Windows settings will not matter.

What if I cannot access the VM at all?

Use the Azure Serial Console or Run Command feature to access the system and repair firewall or service issues.

Conclusion

When an Azure VM responds to ping but refuses RDP connections, the problem almost always lies in network security rules, firewall configuration, or the RDP service itself.

By systematically checking:

• NSG rules
• VM networking
• Windows firewall
• RDP services
• Azure security policies

you can quickly isolate and resolve the issue.

The key lesson from real-world Azure troubleshooting is simple:

Always start with Azure networking before diving into the operating system.

This structured approach saves time and prevents unnecessary guesswork.

Last Updated

Last Updated: March 2026

This troubleshooting guide reflects current Azure VM networking and security practices.

Daniel Lutton

From my early days on the helpdesk through roles as a service desk manager, systems administrator, and network engineer, I’ve spent more than 25 years in the IT world. As I transition into cyber security, my goal is to make tech a little less confusing by sharing what I’ve learned and helping others wherever I can.