I have launched a recovery drill instance from AWS DRS. When I try to connect to it through RDP i am getting these two errors from AWS console

1. You may not be able to connect to this instance as ports 3389 may need to be open in order to be accessible. The current associated security groups don't have ports 3389 open.

2. Password is not available. Please wait at least 4 minutes after launching an instance before trying to retrieve the auto-generated password.

The instance is in a private subnet. There is a working VPN connection between a subnet on-prem and AWS VPC (someone on-prem can successfully ping the instance's IP). The error this someone is getting from the RDP client is:

The remote computer that you are trying to connect to requires Network Level Authentication (NLA), but your Windows domain controller cannot be contacted to perform NLA. You can try connecting to the remote computer using your username and password instead.

I have rechecked my launch template. It has the correct subnet, and the keypair is attached. Ports 3389 is also enabled where needed.

I have relaunched atleast 3 times but i still get the same errors.

I also tried to install an SSM agent as a post-launch setting but it seems it has not worked.

IDK where else to look