SEC_E_UNKNOWN_CREDENTIALS (0X8009030D) Fix for Remote Desktop

When Does This Error Show Up?

You're trying to Remote Desktop into a Windows machine — could be a server or your own desktop. You type your username and password, click connect, and bam: "An authentication error has occurred. The credentials supplied to the package were not recognized." The exact error code is 0x8009030D (SEC_E_UNKNOWN_CREDENTIALS).

This usually happens after you change your Windows password, or when you're connecting from a domain-joined PC to a workgroup machine. I see it most often after a password reset or when someone uses a cached credential that's stale.

Root Cause

What's actually happening here is that Network Level Authentication (NLA) checks your credentials before it even starts the RDP session. NLA is picky — it compares the credentials you supply against what Windows has stored for that user. If there's any mismatch (wrong password, expired password, or the user doesn't exist on the target), it throws this error.

Another common trigger: your Remote Desktop client (mstsc.exe) caches old credentials in Windows Credential Manager. When the server says "try again," the client silently retries with the cached copy instead of prompting you for fresh ones. So you never get a password prompt — just this error.

Fix: Step by Step

Step 1: Clear Stored Credentials (Most Likely Fix)

1. Open Control Panel → User Accounts → Credential Manager.
2. Click Windows Credentials.
3. Look for any entry under "Generic Credentials" that starts with TERMSRV/ followed by the computer name or IP you're connecting to. Example: TERMSRV/192.168.1.50 or TERMSRV/SERVER01.
4. Remove that entry. Click Remove, confirm.

Now try RDP again. You'll get a fresh password prompt. Type the correct password, check "Remember me" if you want, and connect.

Step 2: Check NLA Settings on the Target

If step 1 doesn't help, the target machine might have NLA turned on in a way that rejects your credentials. On the remote computer:

1. Press Win+R, type sysdm.cpl, hit Enter.
2. Go to the Remote tab.
3. Under Remote Desktop, make sure Allow remote connections to this computer is checked.
4. If you see Allow connections only from computers running Remote Desktop with Network Level Authentication — it's checked. That's fine, it's the default. But if you still can't connect, try unchecking it temporarily just to test. If it works without NLA, you know the problem is credential validation, not the network.

Opinion: I never recommend leaving NLA off permanently. It's a security feature that prevents brute-force attacks. Only disable it to diagnose, then re-enable.

Step 3: Verify User Account and Password

Sounds dumb, but check these on the target machine:

• Is the user account locked out? (net user username /domain or locally)
• Has the password expired? Run net user username on the target and look for "Password expires."
• Is the user account disabled? Same command, check "Account active."

If the account is local (not domain), you can reset the password directly on that machine via net user username newpassword from an admin command prompt.

Step 4: Check Certificate Issues (Advanced)

If you're connecting to a server with a self-signed certificate, and the client doesn't trust it, you might still see 0x8009030D. The reason step 3 works is that NLA wraps its authentication in TLS or Schannel. If the certificate is expired or revoked, the handshake fails before credentials are even checked.

On the target machine, open certlm.msc (Local Machine certificate store) and check the Remote Desktop certificate under Remote Desktop folder. Make sure it's not expired. If it is, regenerate it via Group Policy or by running certutil -repairstore my commands — but honestly, if you're not a sysadmin, just reboot the machine. Sometimes Windows renews the self-signed cert on reboot.

If It Still Fails

Try these in order:

• Reboot both machines. Cached state gets cleared.
• Update your RDP client. On Windows 10/11, go to Settings → Apps → Optional Features. Check if Remote Desktop Client is up to date. The latest version (as of 2024) is 1.2.4674.
• Check network firewall. Port 3389 (TCP) must be open from client to target. Run Test-NetConnection -ComputerName target-ip -Port 3389 in PowerShell.
• Last resort: Uninstall and reinstall the Remote Desktop Services feature on the target. Open an admin PowerShell and run Remove-WindowsFeature RDS-RD-Server, then re-add it. This resets all RDP configuration.

If none of that works, you might have a deeper domain trust issue or a corrupted user profile. At that point, create a new local admin account on the target and try connecting with that. If it works, migrate your data from the old profile.