If certificate fixes do not work, verify the basic network path and firewall rules:

The Remote Desktop Service lacks permissions to read the private key of the certificate it is trying to use.

The RDP listener uses a certificate from the Remote Desktop store. If the certificate is expired, self-signed without trusted chain, or uses unsupported key length (<2048 bits), the TLS handshake fails, returning 0x904 on the client.

If the server is forced to use SSL/TLS but the client requests Negotiate with incompatible settings, a handshake failure may produce 0x904.

Add the account and ensure it has Read permissions. 4. Network and Firewall Verification