Secure Access ZTNA RDP Private Resource Access Failure for One Specific Resource

Issue

Users were unable to access one specific RDP private resource through Cisco Secure Access Zero Trust Network Access (ZTNA). When attempting to connect, users received an "internal error occurred" message. The issue affected multiple users, including newly added users, and prevented work-from-home users from accessing required desktop resources. Other RDP resources and non-RDP private resources remained accessible, indicating the problem was specific to this particular resource configuration.

Environment

• Cisco Secure Access - Zero Trust Network Access (ZTNA)

• Private Resource configuration with RDP protocol

• Active Directory (AD) group-based access policies

• Multiple private resource configurations with overlapping IP addresses

• Client-based enrollment and posture assessment

Resolution

The issue was resolved by identifying and correcting configuration conflicts in the private resource setup. The steps described in the next sections were taken to resolve the problem.

Identify Configuration Conflicts

Investigation revealed that the specific RDP resource was configured under multiple private resources: Login to CSA Dashboard > Connect > End User connectivity > Under Zero Trust Access > Add a ZTA profile > Give it a Name, then search for specific destination.

Remove Conflicting IP Address Assignments

The IP address 172.26.106.136 was removed from conflicting private resources.

The IP address was left only under the appropriate resource that matched the users' Active Directory group memberships and access policy requirements.

Verify User Group Membership

Confirmation was made that newly added users who were experiencing access issues were not members of the correct Active Directory (AD) group required for access as per the configured access policy.

Also, ensure that correct AD group or User is associated to Zero Trust Access Profile.

Test Access After Configuration Changes

After the configuration changes were implemented, users were able to successfully access the RDP resource as required. It was confirmed that the issue was resolved and users could connect without receiving the "internal error occurred" message.

Cause

The root cause of the issue was a configuration conflict where the specific resource was assigned to multiple private resources with different access policies. This created a situation where users were being evaluated against policies for which they did not have the appropriate Active Directory group membership, resulting in access denials and the "internal error occurred" message. The newly added users were not members of the correct AD groups required for the conflicting policies, which prevented them from accessing the resource even though they must have had access through the appropriate policy.

Related Content

• Cisco Technical Support & Downloads

Revision History

Revision	Publish Date	Comments
1.0	25-Aug-2026	Initial Release