AWS EC2实例登录失败求助：Remote Desktop认证错误（功能不支持）

Hey there, let's tackle that RDP authentication error you're seeing with your AWS EC2 Windows instance:

Remote Desktop Connection
An authentication error has occurred.The function requested is not supported

You mentioned it worked fine two weeks ago with the correct password, and there's no extra detail in the error. First off—yes, you absolutely can access relevant logs directly through the AWS Management Console to get to the bottom of this. Let's walk through how to do that, plus some common fixes tied to that specific error message:

Since the instance was working normally recently, it's likely still running (even if RDP isn't connecting). Here are the two quickest ways to pull diagnostic logs right from the console:

• Get System Log: Navigate to your EC2 instance in the console, right-click it → Instance Settings → Get System Log. This log captures Windows boot processes, service startup statuses, and even authentication-related errors that might pop up before the login screen loads. Keep an eye out for entries linked to TermService (the Remote Desktop service) or failed authentication attempts.
• Get Instance Screenshot: Also under Instance Settings, select Get Instance Screenshot. This shows you exactly what's on the instance's screen—if it's stuck on a hidden error prompt, or if the login screen is behaving unexpectedly, this can give you immediate, visual clues.

This specific RDP error almost always stems from mismatched security settings between your local RDP client and the EC2 instance. Since it worked two weeks ago, something likely changed (either a Windows update on the instance, or a security configuration tweak). Here's how to diagnose and fix it:

• Use AWS Systems Manager Session Manager to Access the Instance: Session Manager lets you connect to your EC2 instance directly from the console without needing RDP—perfect for situations like this. Once connected:
  1. Open the Local Group Policy Editor by running gpedit.msc in the command prompt.
  2. Navigate to Computer Configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Security.
  3. Look for the setting Require use of specific security layer for remote (RDP) connections. If it's set to SSL (TLS 1.0) and your local RDP client has TLS 1.0 disabled (a common security practice), this will trigger the error. Change it to Negotiate or RDP, then restart the Remote Desktop service with net stop termservice && net start termservice in the command prompt.
  4. Also check the Set client connection encryption level setting—make sure it's not set to a level your local client doesn't support (like High Level if your client is outdated).
• Check for Recent Windows Updates: If the issue started after an update was installed on the instance, some updates modify RDP security defaults. You can use Session Manager to uninstall recent updates via Control Panel > Programs > Programs and Features > Installed Updates.

If you can't connect via Session Manager either, you still have options to retrieve logs:

• EC2 Serial Console (for Windows): If you enabled the serial console for your instance beforehand, you can access it from the EC2 console. Once logged in, pull event logs using commands like wevtutil qe System /f:text to view system logs, or wevtutil qe Security /f:text to check authentication-related events. Look for Event IDs 4625 (failed logins) or 1024 (RDP service errors).
• Attach the Root EBS Volume to Another Instance: Stop the problematic instance, detach its root EBS volume, then attach it as a secondary volume to a working Windows EC2 instance. Once mounted, navigate to the volume's C:\Windows\System32\winevt\Logs folder—you can open the System.evtx and Security.evtx files to review logs for RDP or authentication issues.

内容的提问来源于stack exchange，提问作者Saturn CAU