不能RDP到Windows Server 2016：0x80090302

我试图RDP到多个Windows Server 2016虚拟机没有成功。 它被join到一个域，我正在使用一个域帐户。

我看到在服务器上的错误是事件ID 4625：

An account failed to log on. Subject: Security ID: NULL SID Account Name: - Account Domain: - Logon ID: 0x0 Logon Type: 3 Account For Which Logon Failed: Security ID: NULL SID Account Name: XXXX Account Domain: XXXX Failure Information: Failure Reason: An Error occured during Logon. Status: 0x80090302 Sub Status: 0xC0000418 Process Information: Caller Process ID: 0x0 Caller Process Name: - Network Information: Workstation Name: XXXX Source Network Address: XXXX Source Port: 0 Detailed Authentication Information: Logon Process: NtLmSsp Authentication Package: NTLM Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon request fails. It is generated on the computer where access was attempted. The Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network). The Process Information fields indicate which account and process on the system requested the logon. The Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. 

我相信这可能是NTLM身份validation的问题，因为这应该已被禁用，但事件日志仍显示NTLM作为身份validation包。

在域控制器和服务器上设置以下本地安全策略：

• 2012 R2 RDS Farm会议主机桌面 – 墙纸不显示
• 通过远程桌面login到Windows 2012 R2后，“访问被拒绝”信息
• 远程桌面连接错误远程桌面服务当前正忙
• windows server 2012 R2中的三重DES 168破坏了RDP
• 远程桌面会话中的拨号连接问题

• networking安全：LAN Manager身份validation级别： 仅发送NTLMv2响应。 拒绝LM和NTLM
• networking安全：基于NTLM SSP的客户端/服务器的最小会话安全性： 要求NTLMv2会话安全性，要求128位encryption
• networking安全：此域中的NTLM身份validation： 全部拒绝

registry项目HKLM \ SYSTEM \ CurrentControlSet \ Control \ Lsa \ LmCompatibilityLevel已按照https://technet.microsoft.com/en-us/library/cc960646.aspx在服务器上设置为5

我可以远程进入这些，如果我禁用允许连接只能从运行远程桌面与networking级authentication的计算机，虽然这不是一个长期的解决scheme。