A RDP connection fails with a log entry similar to: CSSP Packet contains NTSTATUS error code; error_code='C0000071'
As the status code C0000071 indicates the user account password may be expired.
C0000072 may indicate the account is disabled.
C0000064 my indicate there is no such user.
C000006E may indicate an account restriction such as time-of-day restriction
Review the account for expired passwords, locked status, time restrictions etc and correct as required.
Enhancement Request PAM-4718 has been created to review the possibility of surfacing further details regarding these failures to the user. There is currently no ETA for this potential enhancement.