Well, might need more specifics about the setup to know for sure, but just tossing out a guess here....
if this is windows 10, it may be a known issue.
defect AAWIN-2315 has been opened to track the issue.
The Windows 10 update from 9 August 2016 contains updates to Windows authentication methods. Listed in the Known Issues section of MS16-101, is the following note:
This security update disables the ability of the Negotiate process to fall back to NTLM when Kerberos authentication fails for password change operations.
From the RSA Authentication Agent logs, it seems that the application being used to collect credentials for RDP on Windows 10 is now C:\Windows\System32\CredentialUIBroker.exe, rather than C:\Windows\System32\mstsc.exe. That change breaks the logic used by the RSA agent to identify the RDP use case (in which the RSA agent defers authentication to the Microsoft password provider)
