Troubleshooting

Remote Desktop

Redundant "Your credentials did not work" dialogs

Symptom: You've configured valid credentials, but each time you try to connect to a VM, the Your credentials did not work dialog appears. After re-entering the same credentials again, the connection succeeds. This issue can be caused by the Always prompt for password upon connection group policy setting. This policy is configured by default on CIS hardened images. IAP Desktop cannot distinguish between genuine authentication failures and prompts triggered by this policy.

Credentials are rejected

Symptom: You've configured valid credentials, but each time you try to connect to a VM, the Your credentials did not work dialog appears. Re-entering the credentials does not solve the issue. This behavior can occur if the LAN Manager authentication level of your local workstation and the VM are incompatible. Because of the way IAP Desktop tunnels RDP connections, it always uses NTLM for authentication and can't use Kerberos. Depending on the LAN Manager authentication level configured on both machines, authentication will either use NTLM or NTLMv2. If you've configured the VM to demand NTLMv2 (authentication level 5), but your local workstation uses level 1, 2, or 3, protocol negotiation fails and your credentials are rejected. To solve this issue, make sure that the LAN Manager authentication level on both machines is compatible.

Desktop firewall warnings

Symptom: Your local Desktop firewall shows a warning every time you connect to a VM instance by using IAP Desktop. For each VM instance you connect to via Cloud IAP, IAP Desktop opens a TCP socket that listens on 127.0.0.1 (using a dynamic port number). This port is necessary to relay the RDP traffic from the Remote Desktop component to Cloud IAP. You can therefore ignore these warnings.

Other errors

If you are seeting other error messages, try manually establishing a Cloud IAP TCP forwarding tunnel: If you have not installed the Cloud SDK yet, download and install it first. Open a command prompt window (cmd.exe). Run the following command: gcloud compute start-iap-tunnel [INSTANCE_NAME] 3389 --project=[PROJECT] --zone=[ZONE] --local-host-port=localhost:13389 Replace [INSTANCE_NAME] by the name of an instance and [PROJECT] and [ZONE] by the project and zone the instance is located in. Wait for the output Listening on port [13389]. to appear. Launch mstsc.exe and try to connect to localhost:13389. If establishing the tunnel does not work, check if a local firewall is blocking gcloud from binding to a local port or blocking communication with Cloud IAP.