Troubleshooting

Remote Desktop

Redundant "Your credentials did not work" dialogs

Symptom: You've configured valid credentials, but each time you try to connect to a VM, the Your credentials did not work dialog appears. After re-entering the same credentials again, the connection succeeds. This behavior can be caused by the Always prompt for password upon connection group policy. This policy is configured by default on CIS hardened images. IAP Desktop cannot distinguish between genuine authentication failures and prompts triggered by this policy.

Desktop firewall warnings

Symptom: Your local Desktop firewall shows a warning every time you connect to a VM instance by using IAP Desktop. For each VM instance you connect to via Cloud IAP, IAP Desktop opens a TCP socket that listens on 127.0.0.1 (using a dynamic port number). This port is necessary to relay the RDP traffic from the Remote Desktop component to Cloud IAP. You can therefore ignore these warnings.

Other errors

If you are seeting other error messages, try manually establishing a Cloud IAP TCP forwarding tunnel: If you have not installed the Cloud SDK yet, download and install it first. Open a command prompt window (cmd.exe). Run the following command: gcloud compute start-iap-tunnel [INSTANCE_NAME] 3389 --project=[PROJECT] --zone=[ZONE] --local-host-port=localhost:13389 Replace [INSTANCE_NAME] by the name of an instance and [PROJECT] and [ZONE] by the project and zone the instance is located in. Wait for the output Listening on port [13389]. to appear. Launch mstsc.exe and try to connect to localhost:13389. If establishing the tunnel does not work, check if a local firewall is blocking gcloud from binding to a local port or blocking communication with Cloud IAP.