First login
OCI Windows platform images create a user named opc with a one-time initial password shown on the instance details page. You must change it at first login.
- The initial password only works until it's changed. If someone changed it and lost it, see Locked out below.
- RDP clients that don't support "password change required" (some older Mac and Linux clients) fail at first login. Use the Microsoft Remote Desktop client.
Network checklist
- The security list or NSG allows TCP 3389 from the user's IP. Avoid
0.0.0.0/0, and prefer Bastion or VPN. - The subnet routes to an Internet Gateway and the instance has a public IP (or you're connecting privately over VPN or FastConnect).
- The Windows Firewall allows Remote Desktop. It's enabled on platform images, but hardening GPOs may remove it.
Test-NetConnection <public-ip> -Port 3389
Error messages
| RDP error | Cause |
|---|---|
| "Remote Desktop can't connect to the remote computer" | Port 3389 is blocked on the network path, or the instance is stopped |
| "An authentication error has occurred / CredSSP" | Client and server patch levels mismatched (CredSSP encryption oracle). Patch both sides. |
| "The user account has expired / must change password" | The client can't handle password change. Use a modern client. |
| "Your credentials did not work" | Wrong password, or an account lockout policy |
| "The remote computer requires NLA" | The client doesn't support NLA, or the domain trust is broken (domain-joined machines) |
Locked out: recover access
Option 1: Run Command. If the Oracle Cloud Agent's Compute Instance Run Command plugin is enabled and the instance has the policy for it, run a PowerShell command from the console (Instance → Run command):
net user opc 'N3w-Temp-Passw0rd!'
net user opc /active:yes
Enable-NetFirewallRule -DisplayGroup "Remote Desktop"
Run Command also needs an IAM policy that lets the instance read and execute commands. See the Run Command documentation for the dynamic group statement.
Option 2: Console connection (VNC). Create a console connection and use the VNC connection string to reach the Windows login screen through the console. Then use a local account you still know.
Option 3: Offline fix. Stop the instance, attach its boot volume to a helper Windows instance, and change the configuration offline (for example, re-enable RDP through the registry). Take a boot volume backup first.
Tip
Keep a second local admin account (break-glass), with its password in your vault, and make sure Run Command works on every Windows instance. Both make lockouts a five-minute fix.