"The Local Security Authority cannot be contacted" if I choose to use TLS encryption

Hi,

I'm trying to block domain users from accessing a computer through netlogon, so I denied them from accessing this computer through network (in secpol.msc),

Now these users can no longer connect to the workstation with remote desktop, (by default it uses TLS as negotiated), and now they got:

"The Local Security Authority cannot be contacted"

If I configure the terminal service to use RDP security layer, this problem would be gone.

Any thoughts?