RDP session closes immediately after successful NLA handshake using Teleport Community (v17.4.5) — only 3 out of 100 machines work

[vbruge]

Hi Teleport team,

I'm currently deploying Teleport Community Edition v17.4.5 using Docker Compose in an Active Directory environment.

I’ve successfully enabled NLA using the environment variable TELEPORT_ENABLE_RDP_NLA= yes, and the logs confirm that nla: true is active.

The Windows Desktop Service is deployed on a dedicated server joined to the domain, and configured via GPO.
I’ve enrolled around 100 machines in a specific Organizational Unit (OU) in Active Directory.
However, only 3 machines are working, and strangely, they are not even in the same VLAN as the bastion.

Problem:
When I try to connect to most of the enrolled Windows machines:

The session starts
The RDP handshake completes successfully
But the session closes immediately after a few seconds
No desktop is displayed, and the session is marked as ended

Here’s a snippet from the logs:

[INFO] ironrdp_async::connector] Connected with success
[INFO] TDP input streaming finished
[INFO] RDP client exited gracefully
[INFO] Rust RDP loop finished

What I’ve verified:

Manual RDP from another machine using the same account works fine
The machines are reachable and respond to RDP
GPOs are correctly applied (NLA required, RDP enabled)
Certificates are valid and issued by our ADCS
The user has RDP permissions

Questions:

Is this a known limitation in the Community Edition?
Could this be related to the IronRDP implementation or a missing capability in the handshake?
Is there any known issue with VLAN segmentation or SID resolution in large-scale deployments?

Thanks in advance for your help and for the great work on Teleport

[zmb3]

There's not quite enough info for us to help. I'd be interested in seeing:

• Event logs from the Windows side
• More complete Teleport logs
• Your Teleport configuration (are you setting kdc_address? Is Teleport aware of the correct hostname?)

[vbruge]

Hi, thanks for the follow-up. Here are the requested details:

From the impacted machine, I found the following event:

I’ve included a full trace of the session from the teleport container logs. The session starts, the RDP handshake completes, but the session ends almost immediately:

logs_teleport_impact_rdp.txt

Here is the relevant part of my teleport.yaml :

Thanks again for your help!

[zmb3]

Well, that confirms that the Windows host is what's closing the connection. Hard to say why - I would poke around the event logs a bit more and maybe diff the configuration of this host with one that works.

You might also try without NLA to see if the disconnect is related to NLA or something else.

[vbruge]

I found the problem, it was beacause of misconfig of GPO on the Domain Conrtoller (about the legacy)