Windows Remote Desktop (RDP) has a feature called Remote Credential Guard which prevents credentials from the connecting client from being stored on the remote host.
With updates from Server 2025 and adjacent, this integration has been fragile and stopped working in some scnenarios.
For example, Windows 11 (25H2) is not able to authenticate with a Windows Server 2025 (24H2) due to changes in the way the two operating systems.
Passing Kerberos requests back to the client
By design, when the user requests a new ticket on the remote host, it’s proxied back to the connecting client to resolve. This means there is a proxy mechanism between the RDP session and the client to relay these Kerberos requests.
These requests are exchanged over “Protocol Data Units” (PDUs) and both the server and client must have the same list and offsets for PDUs in order to talk successfully.
Windows 11 24H2 and Windows Server 2025 introduce architectural changes that altered the Remote Desktop PDU responsible, specifically named Protocol_RDSTLS. The end result is that the PDUs don’t match and so the proxy requests on the remote host fail because they can’t be relayed back to the client.
This caused a very vague error message 0xc000009a STATUS_INSUFFICIENT_RESOURCES.
The solve for Windows Server 2025
There is a “known issue rollback” (KIR) group policy setting that can help remediate this specific issue. In this case the file was related to KB5087539.
Microsoft.Policies.KnownIssueRollback.KB5087539 260421_03022 Feature PreviewThe related feature flag is 393858191.
reg add "HKLM\SYSTEM\CurrentControlSet\Policies\Microsoft\FeatureManagement\Overrides" /v 393858191 /t REG_DWORD /d 1 /f
For whatever reason it isn't posted on the Resolved issues in Windows Server 2025.Related resources
Some relevant threads (which I could find once I knew the Overrides flag ID) include: