Remote Desktop terms explained: session, console, NLA, CAL

Remote Desktop guides and error messages use a lot of short terms: session, console, NLA, CAL. Knowing what they mean makes errors easier to understand and helps you pick the right fix. This glossary explains the terms you will meet most often when using a Windows VPS or Admin RDP server, in plain language and grouped by topic.

Before you start

• No setup is needed. This page is a reference.
• If you have not connected yet, start with What is RDP (Remote Desktop)? for the big picture.
• Throughout, connection examples use the Remote Desktop port: 203.0.113.10:3389.

Connection basics

• RDP (Remote Desktop Protocol): Microsoft's protocol for showing a Windows desktop over the network and sending your keyboard and mouse back. It carries screen, sound, clipboard and more.
• Client: the app on your device, such as Remote Desktop Connection (mstsc) on Windows or Windows App on Mac and mobile.
• Host: the computer you connect to, here your server.
• Port: the network number the host listens on. Windows uses 3389 by default, so you connect to IP:3389.
• .rdp file: a small text file that stores one connection's address and settings.
• Listener: the part of Windows that waits for incoming Remote Desktop connections on the configured port.

Sessions

• Session: your own signed-in desktop on the server, with its programs and settings. Each user who signs in over Remote Desktop gets a session.
• Session ID: a number Windows gives each session. Commands such as quser show it, and tools use it to sign out or view a session.
• Console session: the session tied to the server's own local screen and keyboard. On a VPS that is what the browser console in your VPS provider's control panel shows.
• Admin mode (mstsc /admin): connects to the administrative session on Windows Server. It does not add sessions or bypass licensing.
• Disconnect: you close the window but stay signed in. Your programs keep running and you can return to them later.
• Sign out (log off): you end the session. All your programs close.
• Idle and disconnected time limits: policies that disconnect an idle session or sign out a disconnected one after a set time.
• Two-session admin limit: without Remote Desktop Services licensing, Windows Server allows two simultaneous administrative sessions.

Security and sign-in

• NLA (Network Level Authentication): you prove who you are before the server builds a full desktop session. This reduces load from bots and blocks some attacks. Modern clients support it.
• CredSSP: the Windows component that passes your credentials securely during NLA. Some update-related errors mention it.
• TLS: the encryption that protects the RDP connection.
• Certificate warning: the message "The identity of the remote computer cannot be verified". It appears because the server uses a self-signed certificate by default.
• Account lockout: a policy that blocks an account after too many wrong passwords.
• Restricted Admin and Remote Credential Guard: optional modes that avoid sending reusable credentials to the server. They are mostly used inside company domains.

Licensing

• RDS (Remote Desktop Services): the Windows Server role for hosting many user sessions.
• RDS CAL (Client Access License): a Microsoft licence needed for each user or device when you go beyond the built-in administrative sessions. Check Microsoft's current documentation and your reseller for terms.
• Grace period: a limited time during which RDS works before licences are installed. After it ends, extra sessions are refused.

Gateways and networking

• RD Gateway: a Windows Server role that accepts Remote Desktop over HTTPS (port 443) and forwards it to servers behind it.
• UDP transport: RDP can use UDP alongside TCP to feel smoother on long or lossy links.
• VPN: a private tunnel. Some people allow RDP only through a VPN for extra safety.
• Latency: the delay for data to reach the server and back. High latency makes typing and mouse feel slow.

Redirection

Redirection means sharing a local device with the remote session.

• Clipboard redirection: copy and paste between your device and the server.
• Drive redirection: your local drives appear on the server, under paths like \\tsclient\C.
• Printer redirection: your local printers show up in the session.
• Audio redirection: server sound plays on your speakers; microphone redirection sends your mic to the server.
• Smart card and USB redirection: pass hardware such as card readers through to the session, with limits.

Check it works

You can see some of these terms live on your server. In a Remote Desktop session, open Command Prompt and run:

quser

You will see your username, a session name such as rdp-tcp#3, the session ID and a state of Active. A user who closed the window without signing out shows as Disc (disconnected).

Troubleshooting

• "The remote computer requires Network Level Authentication": your client or account cannot complete NLA. See Fix "The remote computer requires NLA".
• "Another user is signed in": two sessions are already in use, or your old session is still open. Sign out unused sessions with logoff <ID>.
• Programs closed while you were away: you signed out, or a disconnected-session time limit ended the session.
• "No Remote Desktop license servers available": someone enabled the RDS role without licences. Remove the role or license it properly.

Next steps

• When the server's admin session is busy: Connect to the console session with mstsc /admin.
• Share folders the right way: Share local drives with your server over Remote Desktop.