Windows firewalls show blocking traffic after they are turned off

Question

We have a VM in Azure that we lost RDP connectivity to after turning it off for about a week.

• I checked RDP service and port in serial console, they are running on 3389 as expected.
• After login with a local admin user in serial console, I disabled all three firewall profiles, domain, public and private. No luck. Let's call this problematic VM, vm0. Rebooted, no luck.
• I created a test vm1 in the same subnet. I can RDP to vm1, but from vm1, I still can't RDP to vm0. That shows me that we have no network issue.
• I created a test vm2 in the same subnet. I can RDP to vm2 and RDP to vm1, but can't RDP to vm0. they all have same NSG. That shows me that the NSG has no issue.
• With serial console of vm0, I can ping vm2 after disabling firewalls on vm2. I can also telnet RDP port to vm2. it seems there is no issue for outbound traffic.
• I noticed in logfiles/firewall/publicpw.log that DROP traffic is being logged, so I checked the firewall status and they are still off.
• I restarted NLA service, no luck.

What else is blocking the inbound traffic? I am out of ideas at this point.

Answer 1

It does seem there's something odd going on with that VM. RDP issues with Azure VMs are not rare and they are generally well-documented.

Below are a few things you can try to troubleshoot further. They are based on similar issues I've faced in the past and have helped isolate.

1. Check memory utilisation and change the VM SKU accordingly. Often the wrong size (e.g. using a B1s for Windows VMs) leads to exhaustion quickly which in turn prevents you from even connecting via RDP.
2. Reset the NIC - This will allow you to set a static IP address for the VM. You could just re-purpose one of the other IPs of VM1 or VM2 (after getting rid of them, of course), since you've confirmed these are whitelisted and working etc.
3. Reset the Remote Desktop Configuration
4. Redeploy the VM to a new node
5. Create a new NIC. Since you can't delete the only NIC on a VM, you could consider deleting the VM/Compute resource while keeping the disk, then recreating a VM from the existing disk, as well as a new NIC.

You can also refer to this very comprehensive document from Microsoft on troubleshooting RDP issues related to Windows VMs.