# Troubleshooting

Checks for workspaces when the RDP connection fails, a tool is missing, a port is in use, or a project folder is missing.

> Source: https://www.application-platform.com/en/docs/workspace-vm-troubleshooting/

## Tailscale is not connected

If the Tailscale app does not show **Connected** or your workspace VM is missing from `tailscale status`, your device is not in the workspace network. Sign in to the platform's server, not to an ordinary Tailscale account ([Set up Tailscale]({{< relref "workspace-vm-tailscale" >}})).

## RDP or the desktop does not respond

Compare hostname, port, and username with the **Connect** dialog on the workspace card, restart your RDP client, and connect again; shortly after the VM starts, the services need a moment. `workspace-<slug>.workspaces.vpn.application-platform.com` is only resolved through Tailscale; a foreign host name under `workspaces-dev.application-platform.com` is the public gateway DNS.

### Windows App on macOS: password prompt, then nothing

If the Windows App shows neither connection nor error message after the local password dialog, check in the terminal:

1. `tailscale status` shows the workspace VM as online.
2. `dscacheutil -q host -a name workspace-<slug>.workspaces.vpn.application-platform.com` returns an IP from `100.64.x.x`.
3. `nc -vz workspace-<slug>.workspaces.vpn.application-platform.com 3389` reports the port as reachable.

If steps 2 and 3 work, test with the Tailscale IP instead of the MagicDNS name, or use FreeRDP (`sdl-freerdp`) with `/cert:ignore` for a clear error message. The logs under `~/Library/Containers/com.microsoft.rdc.macos/Data/Library/Logs/Windows App/` indicate a DNS or routing problem with `Name resolution failed` or `Connection refused`, and a sign-in problem with a successful RDP handshake.

### Error `0x207` (“expired password”)

“expired password” with `Error code: 0x207` is misleading; usually the password does not match `gnome-remote-desktop` on the VM, or the CredSSP/NLA handshake fails. Copy the password from the **Connect** dialog; if FreeRDP with `/cert:ignore` reports `AUTHENTICATION_FAILED`, reset the credentials on the VM (`grdctl --system rdp set-credentials …`).

If only the Windows App shows `0x207` or `SSL_ERR_HANDSHAKE_FAILED`, the `.rdp` file needs this line (the platform's file already sets it):

```text
use redirection server name:i:1
```

Delete old PC entries in the Windows App and open the file again, or use `sdl-freerdp … /cert:ignore /gfx`.

## A tool is missing

In a new terminal, check the versions with `asdf current`, change into the project folder with the `.tool-versions`, and run `ap run-local` again; `ap doctor` shows which tool is missing.

## A port is in use

Stop the old process or Docker container that occupies the port and start `ap run-local` again; `ap ports` shows which port belongs to which repository. Backends use `docker compose`, frontends and homepages fixed ports.

## A project folder is missing

Check whether the repository is cloned in the shared project folder; if it is missing, clone it from the GitLab group ([Working with projects]({{< relref "workspace-vm-project-work" >}})).