Disable the message "The logon attempt failed" in RDP on Windows Server

Why is the message "The logon attempt failed" displayed when connecting via RDP?

Message “"The logon attempt failed"” When connecting to a Windows Server via RDP, it can be a sign of several different problems. This error could be caused by *incorrect authentication (username/password)*, *Network Level Authentication (NLA)* issues, account policy restrictions, or even repeated brute-force attacks.

Before attempting to disable or change logging settings, it is important to identify the actual cause of the error to avoid creating unnecessary security risks.

Disable the logon attempt failed rdp settings in Windows Server — what and why?

This message usually refers to one of the following:

• Incorrect username or password.
• Being active NLA and client settings mismatch.
• Policy restrictions such as Allowed Logon Hours.
• Brute-force attacks that generate multiple logs with event ID 4625.
• Authentication settings on the client that cause the error window to appear repeatedly.

Important note: Deleting or disabling Failed Logon logs will result in loss of forensics information and attack detection. It is better to use alternative solutions instead of deleting the logs completely.

Practical ways to disable or manage the “The logon attempt failed” message/log”

1) Remove message display on the client (user-oriented solution, without deleting the server log)

If the goal is to prevent the error window from appearing repeatedly on the client, you can use the following options:

• Use the option Save credentials In Remote Desktop Connection or creating a file .rdp With appropriate settings to remove the credential request every time.
• For enterprise clients, use GPO to set up delegation or Credential Delegation (Computer Configuration → Administrative Templates → System → Credentials Delegation).

Sample content of an .rdp file that is useful for storing credentials:

enablecredsspsupport:i:1
prompt for credentials:i:0
username:s:DOMAIN\username

2) Disable Failed Logon logging on the server (with warning)

Disable login failure logging using Advanced Audit Policy It may prevent the generation of Event ID 4625, but it reduces server security.

Steps (GPO or Local):

• Open Local Group Policy Editor or Group Policy Management: Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration → Audit Policies → Logon/Logoff → Audit Logon
• To prevent failures from being recorded, the option Failure Disable.

Commands to view and modify with the tool auditpol:

auditpol /get /category:*
auditpol /set /subcategory:"Logon" /success:disable /failure:disable
# or to disable only failure
auditpol /set /subcategory:"Logon" /failure:disable

3) Manage brute-force attacks and reduce irrelevant log generation

It is better to use solutions to reduce attacks and log generation before disabling logs:

• Activate Account Lockout Policy (Example: Threshold = 5, Reset = 30 minutes).
• Activate Network Level Authentication (NLA) For RDP.
• Restrict RDP access with a firewall based on valid IP addresses.
• Use RD Gateway or VPN to prevent RDP ports from being open on the public internet.
• Install protection tools like RdpGuard or IPBan to automatically block malicious IPs.

Example firewall command to allow RDP only from a specific IP:

netsh advfirewall firewall add rule name="Allow RDP from Office" dir=in action=allow protocol=TCP localport=3389 remoteip=203.0.113.45/32

Example of changing RDP port with PowerShell (with extreme caution):

Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name 'PortNumber' -Value 3390
Restart-Service TermService -Force

4) Filter or manage the display of logs in Event Viewer

If the goal is only to read the Event Viewer, deleting the log is not necessary. Better options:

• Build one Custom View In Event Viewer to filter event ID 4625.
• Forward logs to SIEM or ELK/Graylog and perform filtering there.

PowerShell example to extract the latest failed login events:

Get-WinEvent -FilterHashtable @{LogName='Security';Id=4625} -MaxEvents 50 | Format-List TimeCreated, Message

Practical examples and quick commands

Here is a set of reference commands for common actions:

• View current Audit policies:

  auditpol /get /category:*

• Disable Failure for Logon:

  auditpol /set /subcategory:"Logon" /failure:disable

• Add a firewall rule to allow RDP only from specific IPs:

  netsh advfirewall firewall add rule name="Allow RDP from Office" dir=in action=allow protocol=TCP localport=3389 remoteip=203.0.113.45/32

• Changing the RDP port (risky — use caution):

  Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name 'PortNumber' -Value 3390
  Restart-Service TermService -Force

• Extracting logs 4625:

  Get-WinEvent -FilterHashtable @{LogName='Security';Id=4625} -MaxEvents 100

Best practices for hosting RDP on cloud infrastructure

Use the following solutions to securely host RDP in cloud environments:

• Using a VPS for trading or gaming With a close location to reduce ping and the ability to lock RDP to a dedicated IP.
• Anti-DDoS server and network firewall to prevent high-frequency attacks on RDP.
• Activate NLA and use of RD Gateway Along with MFA/2FA For more layers of authentication.
• Use of Private Network / VPC And restrict RDP access only through VPN or Jump Box.
• Use a graphics server (GPU Cloud) for heavy workloads and keep administrative access limited.
• Monitoring and forwarding logs to a monitoring service (SIEM) instead of disabling local logging.

Special Tips for Web/DevOps Managers, Traders, and Gamers

Recommendations tailored to different needs:

• WordPress admins and DevOps: When enabling RDP, use SSH tunneling or VPN to access admin panels to keep the RDP port hidden from the public internet.
• Traders: A server in one of 85+ locations Get one near the target exchange and use a VPS for trading with low ping and IP Lock capability.
• Gamers: For the lowest ping and stability, use a gaming VPS or cloud server with BGP networking in suitable locations.

Conclusion

Completely disable message recording or display “"The logon attempt failed"” The solution is not risk-free. The safer route is to first investigate the cause of the error and then use solutions such as restricting RDP access (firewall, VPN, RD Gateway), enabling Account Lockout, and using protection tools.

If you need secure hosting with various locations and features such as a trading VPS, anti-DDoS server, or graphics server, it is recommended that you review the security settings with the relevant support team to ensure a configuration that suits your needs.

Frequently Asked Questions