Remote Desktop login failure after 1+ hour of active session

Martin Ritter When you use a shared account to connect to multiple remote PCs, your client machine relies on the internal Windows Web Account Manager and the Azure Active Directory Broker Plugin to issue access tokens for those connections. At exactly the one-hour mark, the first active session's access token expires, prompting Windows to quietly request a renewal in the background. During this renewal process, the authentication broker essentially locks the token state for that specific shared identity to prevent corruption. If you attempt to launch a second parallel session through RDCMan while this background refresh is actively occurring, the broker cannot process the concurrent request for the same identity. The system defaults to rejecting the connection entirely, which visually surfaces to you as a generic password rejection.

This also explains why closing the initial connection resolves the problem. When you close the first session, you forcefully terminate that background renewal lock, which clears the broker's queue and allows fresh access tokens to be successfully generated for your subsequent connections. You can actually verify this internal traffic collision by checking your Event Viewer under Applications and Services Logs, Microsoft, Windows, AAD, and Operational, where you will likely see overlapping token acquisition errors for the shared account during that one-hour mark.

Because this is an inherent concurrency limitation of the Web Account Manager when handling shared identities across multiple sessions, there is no registry key or command-line tool that will override the broker's locking mechanism. The official architectural guidance remains to provision unique, individual accounts for each user requiring remote access. If that is strictly not possible for your business model, you will have to wait for an official Microsoft update that redesigns how the underlying broker queues concurrent token requests for a single identity.

Hope this answer has brought you some useful information. If it did, please hit “accept answer”. Should you have any questions, feel free to leave a comment.

VPHAN

Hi Martin Ritter,

The authentication failure occurring at the one-hour mark is fundamentally tied to Network Level Authentication and how the Local Security Authority Subsystem Service manages the credential cache for concurrent remote connections. When your initial session remains active, the remote host automatically renews the security token and updates its internal cache via the LSASS.exe process. If you attempt a second connection using the exact same shared account, Network Level Authentication evaluates the incoming credentials against this newly rolled-over cryptographic token, perceives a mismatch in the synchronization state, and outright rejects the password. This background process often generates an Event ID 4625 in your Windows security logs, which serves as the system's way of recording a logon failure despite the password being technically correct.

Because this token desynchronization happens entirely on the remote server's side, standard local administrative interventions like clearing your credential manager or using command-line tools to manually refresh local primary refresh tokens will not bypass the block. Many third-party forums suggest bypassing this known architectural limitation by disabling Network Level Authentication entirely through the registry pathway located at HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp by altering the UserAuthentication value. However, this registry key controls the primary gateway for connection security, and modifying it strips away a critical layer of encryption, exposing your remote desktop infrastructure to severe vulnerabilities and directly violating enterprise security compliance.

There is currently no authorized system configuration change that safely mitigates this token collision for shared identities without severely compromising your environment's security posture. You will need to wait for an official Microsoft update that specifically refines concurrent token handling for shared accounts within the current authentication framework. In the meantime, the most reliable and fully compliant operational approach is to provision unique, individual accounts for each user requiring remote access, which natively prevents these credential cache overlaps and ensures stable connectivity.

Hope this answer has brought you some useful information. If it did, please hit “accept answer”. Should you have any questions, feel free to leave a comment.

VPHAN