diff --git a/ExternalConnectors/TSS/SecretServerInterface.cs b/ExternalConnectors/TSS/SecretServerInterface.cs
index 4a1b2c35..5129e488 100644
--- a/ExternalConnectors/TSS/SecretServerInterface.cs
+++ b/ExternalConnectors/TSS/SecretServerInterface.cs
@@ -194,15 +194,24 @@ namespace ExternalConnectors.TSS
                     }
                     catch (Exception)
                     {
-                        // refresh token failed. maybe the refresh time is over? try to fetch a fresh one.
-                        // if OTP is used we need to ask user for a new OTP
+                        // refresh token failed. clean memory and start fresh
+                        SSConnectionData.ssTokenBearer = "";
+                        SSConnectionData.ssTokenRefresh = "";
+                        SSConnectionData.ssTokenExpiresOn = DateTime.Now;
+                        // if OTP is required we need to ask user for a new OTP
                         if (!String.IsNullOrEmpty(SSConnectionData.ssOTP))
                         {
                             SSConnectionData.initdone = false;
+                            // the call below executes a connection test, which fetches a valid token
                             SSConnectionData.Init();
+                            // we now have a fresh token in memory. return it to caller
+                            return SSConnectionData.ssTokenBearer;
+                        }
+                        else
+                        {
+                            // no user interaction required. get a fresh token and return it to caller
+                            return GetTokenFresh();
                         }
-                        // get a fresh token
-                        return GetTokenFresh();
                     }
                 }
             }
diff --git a/mRemoteNG/Language/Language.resx b/mRemoteNG/Language/Language.resx
index bf6d29e0..80465f73 100644
--- a/mRemoteNG/Language/Language.resx
+++ b/mRemoteNG/Language/Language.resx
@@ -1091,7 +1091,7 @@ If you run into such an error, please create a new connection file!</value>
     <value>Use restricted admin mode on the target host (local system context).</value>
   </data>
 
-  <data name="PropertyDescriptionUseRemoteCredentialGuard" xml:space="preserve">
+  <data name="PropertyDescriptionUseRCG" xml:space="preserve">
     <value>Use Remote Credential Guard to tunnel authentication on target back to source through the RDP channel.</value>
   </data>