Nine times out of ten the server is fine and the problem is on the list below. Work through it top to bottom; most people are connected again by step 2.
1. Is the server actually running?
Open the server in your dashboard. The status badge must say Running. If it says Stopped, click Start. If it says Building, a reinstall or first build is in progress: wait 10 minutes.
2. Reset the password (fixes most cases)
A wrong or out-of-sync password gives the same error as a dead server. On the server page click Reset password. This sets a fresh Administrator password at the hypervisor level, no login needed, and shows it to you. Then connect again with the new password.
Do not reinstall the server to fix a password problem. A reinstall erases everything on it and will not help; the reset takes ten seconds.
3. Brand-new server?
Windows needs 5 to 10 minutes after its first boot before Remote Desktop answers, and the CPU sits near 100% for 15 to 30 minutes while Windows Defender runs its first scan. That is normal. Make a coffee, then try again.
4. Check what you are typing
- Computer: the server's IP address exactly as shown in the dashboard, no spaces.
- Username:
Administrator(not your email, not your BearHost login). - Port: 3389 unless you changed it. If you did, type
IP:port. - Mac users: use Microsoft Remote Desktop from the App Store.
5. Your own network
Some offices, universities and mobile carriers block port 3389. Try from a phone hotspot. If it works there, ask your network administrator to allow outbound 3389, or change the RDP port on the server (see below).
6. Account locked out by brute-force attempts
Every public Windows server gets thousands of password guesses a day. By default Windows locks the Administrator account for a while after too many failures, which locks you out too. Symptoms: it worked yesterday, the password is right, and you get "account is currently locked out" or a silent refusal.
Fix it from the dashboard console (no RDP needed): open Console on the server page, log in, open PowerShell as Administrator and run:
net user Administrator /active:yes
Then stop it recurring, in order of preference:
- Change the RDP port. Attackers only scan 3389. Run, then reboot:
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" -Name PortNumber -Value 3390
New-NetFirewallRule -DisplayName "RDP 3390" -Direction Inbound -Protocol TCP -LocalPort 3390 -Action Allow
Afterwards connect to IP:3390.
2. Use a long password (16+ characters). Guessing then fails for years.
3. As a last resort, disable the lockout threshold: net accounts /lockoutthreshold:0. Only combine this with a long password.
7. Firewall inside Windows
If you changed Windows Firewall or installed security software and lost access, use the dashboard Console, which works even when the network is blocked, and allow Remote Desktop again:
Enable-NetFirewallRule -DisplayGroup "Remote Desktop"
Still stuck?
Open a ticket from the dashboard with the exact error text and the time you tried. We can see the server's power state, network and login attempts from our side and usually reply within the hour.