This behavior is a classic “Catch-22” involving how Windows handles security and how the Mac version of the Windows App (formerly Microsoft Remote Desktop) manages connections compared to its Windows counterpart.
The most likely reason this happens is that after a restart, your remote PC is sitting at the Windows Login Screen. In this state, two things are often true:
- The VPN Gap: GlobalProtect may not have established its tunnel yet (it’s waiting for a user to log in to “start” the session).
- The NLA Handshake: The Mac app is often more “strict” about Network Level Authentication (NLA). If the remote PC hasn’t fully initialized its network stack or user session, the Mac client fails to negotiate the security handshake, whereas a Windows-to-Windows connection is better at “forcing” the login prompt to appear.
Here is how you can fix this:
1. Disable “Network Level Authentication” (The most likely fix)
By default, Windows only allows connections from computers running “Remote Desktop with NLA.” While more secure, this often prevents Mac clients from reaching a machine that hasn’t had a local user log in yet.
- On your Remote Windows PC:
- Open Settings > System > Remote Desktop.
- Click on Advanced settings.
- Uncheck the box that says “Require computers to use Network Level Authentication (NLA) to connect.”
- Try restarting and connecting from your Mac again.
2. Request “Pre-Logon” from your IT Department
If your remote PC is invisible to your Mac until you log in via another PC, it’s because the GlobalProtect VPN tunnel isn’t active until a user logs in. Windows RDP works locally, but over a VPN, the “pipe” isn’t open yet.
- The Fix: Ask your IT administrator to enable GlobalProtect Pre-logon for your machine.
- How it works: This allows the remote PC to connect to the VPN as soon as it reaches the Windows Login screen, before anyone actually signs in. This makes the machine “visible” to your Mac immediately after a reboot.
3. Enable “Connect Before Logon” (CBL)
If you have administrative rights on the remote PC, you can try enabling the Connect Before Logon feature in the GlobalProtect settings. This allows the VPN to be triggered from the login screen.
- On the remote PC, open the Registry Editor (
regedit). - Navigate to:
HKEY_LOCAL_MACHINE\SOFTWARE\Palo Alto Networks\GlobalProtect\CBL - If it doesn’t exist, create a string value named
AlwaysShowPortaland set it toYES. - This adds a small icon to the Windows login screen (bottom right) that allows the VPN to connect before the user logs into Windows.
4. Use the IP Address instead of the Hostname
Sometimes, after a restart, the remote PC’s DNS name (e.g., MyWorkPC) hasn’t been registered with the office network yet.
- Find your remote PC’s internal IP address (e.g.,
10.x.x.x). - In the Windows App on your Mac, change the “PC Name” to that IP address instead of the computer name. IP addresses are “static” and don’t rely on the network’s directory services being fully awake after a reboot.
Summary Checklist
| Action | Why it helps |
|---|---|
| Disable NLA | Allows the Mac app to “see” the login screen without a pre-existing session. |
| Enable CBL | Edit the registry to allow GlobalProtect to Connect Before Logon (CBL) |
| Enable Pre-logon | Ensures the VPN is active even when no one is logged in. |
| Use IP Address | Bypasses potential DNS delays that happen right after a reboot. |
If none of these solutions work …
- Use a Windows computer to connect to the remote Windows machine. Once it has a user logged in, it will be able to accept connection from a Mac.
- If you have two such remote Windows machines, you can use two layers of remote desktop connection to log into the freshly started one.
- Do not restart both computers at the same time. Otherwise, you will not be able to log into any of them from a Mac.
- Restarting machine A, then remote desktop to machine B from a Mac, then remote desktop to A from B once A restarts, then remote desktop to B from the Mac, then restart A either from the Mac or B.
Content is based on Gemini responses.