Vista Remote Desktop Connection Authentication FAQ

Vista Remote Desktop Connection Authentication FAQ

Rate This

 Update: Some additional improvements are coming in this area.  Please see this article.

There has been a lot of feedback about the new authentication features introduced in the latest version of the Remote Desktop Connection client. These features are part of our efforts to improve security for Terminal Services (TS) in Windows Vista and Windows Server code name “Longhorn” , however some users have run into a variety of problems that have caused frustration. In order to alleviate some of the frustrations, below is an FAQ on various symptoms users have run into, along with solutions and workarounds.

  1. Prompted for Authentication Twice when connecting to TS in Windows Server 2003
  2. Prompted for Authentication Twice when connecting to TS in Windows 2000 Server
  3. Credentials Entered in TS client rejected when connecting to Windows Server 2003
  4. Saved credentials do not work
  5. Cannot use smart card credentials to logon when running Remote Desktop on XP or Windows Server 2003?
  6. How to remove invalid pre-populated domain names
  7. The pre-populated username in the credentials dialog does not match the username that is in the RDP file?
  8. Can’t change domain name when running Vista Remote Desktop Connection client.
  9. How to eliminate the  ‘Remote Desktop Cannot verify the identity of the computer you want to connect to…” messages
  10. When to use the “enablecredsspsupport:i:0” RDP file option.

Prompted for Authentication Twice when connecting to TS in Windows Server 2003

When using Remote Desktop Client 6.0 to connect to a Windows 2003 machine, some users have to enter credentials twice. Once before connection they will see Picture 1 below if they have Windows XP or Windows Server 2003 as the client or Picture 2 if they are using Windows Vista as the client.

Picture 1 - Windows XP - Windows Server 2003

Picture 1

Picture 2 - Windows Vista


 The second time they will be prompted as the remote servers logon screen (picture 3)

No error messages will be shown.

Picture 3

 

Answer: This is most likely the result of the way the remote server is configured. There are two possible settings that may be causing this:

  1. The most likely is the “Always prompt for password” setting is enabled on the server. In order to disable the setting,  the administrator of the server you are connecting to must run Terminal Server Configuration administrative tool (tscc.msc) and double click on RDP-Tcp. In the “Logon Settings” tab, there is an option labeled “Always prompt for password” (see the option circled in red below).

  2. Alternatively: For Windows Server 2003, an administrator may have set the group policy located at: “Administrative Templates\Windows Components\Terminal Services\Encryption and Security\Always prompt client for password upon connection”. For Vista, this same policy is located “Administrative Templates\Windows Components\Terminal Services\Terminal Server\Security\Always prompt client for password upon connection.”  Note: This policy is set as not configured by default; if this has been set remember it could have been configured either on the local group policy or a domain based group policy.

When either the option in Terminal Server Configuration administrative tool (tscc.msc) is selected or the group policy is enabled, the TS server will always show a winlogon prompt, regardless of what version of the Remote Desktop Client the user is running.

Prompted for Authentication Twice when connecting to Terminal Services in Windows 2000 Server

Why do users always have to enter credentials twice on Windows 2000 Server?

Answer: The setting in tscc.msc mentioned in the first question is enabled by default on Windows 2000. The administrator should disable this setting to fix the undesired behavior. Afterwards, the user can expect to not run into the winlogon screen or duplicate prompts.

Credentials Entered in TS client rejected when connecting to Windows Server 2003

Why is it that when connecting to Windows Server 2003, the credentials entered in the credentials dialog are rejected as follows:

AlwaysPrompt

Answer: The above behavior is caused when winlogon on the TS server cannot validate your credentials. This may be from a number of reasons: For example, the password or username may be incorrect. Other times, (and this may be the most frustrating to users), the domain may be in a format that is not recognized by the TS server. The best thing to do, when entering credentials into the credentials dialog, is to make sure that the domain, username, and password are all in a format that the server will accept. For example, let’s say one tries to connect to MyServer and you intend to log in with the MyUserName account from the MyDomain domain. If the user will just type in “MyUserName” in the User Name field in Credentials Dialog, the Windows 2003 Server will automatically pick “MyServer” as the domain value for login and the login will fail. But if the user provides “MyDomain\MyUserName” as input for the User Name, logon will complete successfully.

Saved credentials do not work

Despite having saved credentials, users are still prompted to enter credentials on the remote server’s winlogon screen.

Answer: This can be due to one of two reasons. Either one of the policies mentioned in the answer to the first question are enabled, or the credentials that have been saved are not valid.

In instances where the saved credentials are not valid, there is one possible scenario that may lead to this behavior and cause user confusion. Consider the following:

  1. User tries to connect to server. His username is “MyDomain\test1” and his password is “LogMeOn”
  2. In the credentials dialog, user mistypes his credentials. For his password, instead of typing “LogMeOn”, he types “LogMeO”.
  3. User hits connect, and hits the winlogon screen. There is an error on the server stating “The system could not log you on. Make sure your User name and domain…”, just as in the example above
  4. User properly types his credentials into winlogon, and gets his session.
  5. The next time he goes to connect to the server, the saved credentials will not work.

This is because the credentials that have been saved on the client side are:        

Username: MyDomain\test1

          Password: LogMeO

Note that the password saved is not correct. This happens because whenever the user selects “Remember my credentials” in the credentials dialog, the credentials that are saved are whatever was typed in the credentials dialog. If the credentials are updated after connecting to the server, the correct credentials are not propagated back to the TS client and updated.

If the saved credentials are not correct, you may edit or delete them in Remote Desktop by clicking on the “Options” button. The dialog below should appear. Clicking “delete” will delete the saved credentials, and clicking “edit” will allow you to modify them.

Note that if the text “The saved credentials for this…” do not appear, then credentials are not saved.

Cannot use smart card credentials to logon when running Remote Desktop on Windows XP or Windows Server 2003?

Some users are having trouble using smart card credentials to logon.

Answer: To ensure that you can connect to Windows XP or Windows Server 2003 with smartcards, make sure that smartcards redirection is enabled.

  1. Smart cards must be redirected. To redirect smart cards, click “Options” and select the “Local Resources” tab. In the tab, click on the button labeled “More”. In the dialog that pops up, make sure “Smart Cards” is clicked, as shown below:

  2. Use the drop down box in the credentials dialog to select your smart card credentials. In the example below, the user has the credentials “ZK-07\Administrator” selected. Instead, he needs to select the smart card credentials “Foo-Bar - ITG XXXXX” that is circled in red below.

How to remove invalid pre-populated domain names

Some users have noticed that an invalid pre-populated domain name is placed in front of the user name in the credential dialog. Users are frustrated at having to delete this bad domain on every connection. The sequence of steps causing this behavior is as follows:

  1. User wants to connect to a machine via IP address, say 127.0.0.1.
  2. He enters the correct password and username “Administrator”. He successfully logs on.
  3. The next time he attempts to connect to 127.0.0.1, he sees in the “User name” field of the credentials dialog “127.0.0.1\Administrator”. The user deletes the text “127.0.0.1\” from the user name field and logs on. On successive connections, he is forced to keep deleting this extraneous text.

Answer: When a domain is not presented for the username, Remote Desktop assumes by default that a local server account will be used and the domain name is pre-filled accordingly. In this case, the server name entered was “127.0.0.1”, and as a result, the domain entered was the same. This was done for various reasons in Vista that are too complicated (and irrelevant) to go into detail here.

The best workaround for this behavior is to always enter a proper domain into the credentials dialog. If you are connecting to machine “MyMachine” using the “Administrator” account, do not just enter “Administrator” as the username, enter “MyMachine\Administrator”. From there on out, the proper domain and username will be prepopulated in the credentials dialog. Alternatively, if the user account is an account named “DomainUser” in the domain “MyDomain”, use “MyDomain\DomainUser” instead of just “DomainUser”.

The pre-populated username in the credentials dialog does not match the username that is in the RDP file?

Despite having a string in the RDP file “username:s:Machine\Administrator”, the pre-populated username in the credentials dialog is something different (or maybe even blank).

Answer: This is a result of a design change. Instead of populating the credentials dialog with the last username used to connect to any server, we felt (and received positive feedback) that we should populate the credentials dialog with the last username used to connect to the specific server the user is connecting to. We felt this would provide a better experience. The downside is that users connecting to various machines with the same username would now have to reenter the username once upon their first connection to a machine. From then on, the username will be pre-populated on subsequent connections.

Can’t change domain name when running Windows Vista Remote Desktop Connection client:

In the dialog below, some users don’t see how to change the domain from “127.0.0.1” to “MyDomain”

Answer: To change the domain used in the credential dialog box show above you simply put a fully qualified domain username or UPN.  For example if the domain is called “MyDomain”. Simply enter “MyDomain\<username>” or username@domain.<fqdn> into the username field and the domain will automatically be updated, as shown in the two examples below.

 

 

 

How to eliminate the ‘Remote Desktop cannot verify the identity of the computer you want to connect to…” messages

When you connect to server with the ‘always connect, even if authentication fails’ setting set you will see the following notification dialog:

 

Answer: Before connecting, in Remote Desktop, do the following:

  1. Click on “Options”
  2. Click on the “Advanced Tab”
  3. In “Authentication Options”, select “Always connect, even if authentication fails, as seen below:

This will disable the warning prompt. Please be aware that selecting this option makes it possible for attackers to intercept and modify the data exchanged between client and server.

When to use the “enablecredsspsupport:i:0” RDP file option.

Several other forums on the internet have suggested placing “enablecredsspsupport:i:0” in the RDP file used by the Remote Desktop client.

Answer: This option does disable the new credential prompting behavior, but it also disables support for Network Level Authentication for Vista (and Longhorn Server) RDP connections; Network Level Authentication requires credentials to be provided by the client before a session is created on the server side.

This option is meant for dealing with unexpected failures on connections using Network Level Authentication.

We strongly recommend users avoid using this flag unless none of other fixes described in this post work and no other alternative is available.  If this setting is used try to limit its scope as much as possible by using it only those RDP files meant for connections to specific servers (i.e. avoid setting it in your Default.rdp file).

Deploying this configuration option widely will cause hard to diagnose issues when connecting to Vista and Longhorn Server computers that require Network Level Authentication.

 Update: Some additional improvements are coming in this area.  Please see this article.

Leave a Comment
  • Please add 2 and 8 and type the answer here:
  • Post
  • Having an issue with an XP Client running RDP6 connecting into a Vista Ultimate machine.  I receive "An authentication error has occurred (Code: 0x80090330)."  Under the options on the RDP6 client, I have it set to "Always connect, even if authentication fails."

    If I enable the “enablecredsspsupport:i:0” option by adding it to the RDP file, the RDP6 client connects without a problem.

    This problem started after I experienced a problem with a network card driver, and upon having difficulties removing it via Device Manager, Registry, etc..., I did a System Restore.  Everything works fine since, except for this Remote Desktop Error.  Any help would be appreciated.  Thanks.

    Eric

  • Just to clarify, the network card problem was on the Vista machine, not XP.

  • Hello, i'm connecting to a windows server 2003 using RDP from a windows xp machine to run  a vfp application..no problem.

    I buy a brand new pc with windows vista and run RDC..logon ok...but when i run my application it do not refresh the windows...i have to minimize an maximize the aplication to make it happen.

    Can I install old windows XP RDP client on my vista??

    thanks

  • So is there *any* workaround to have saved credentials in each rdp-file again as it worked with the previous Remote Desktop Client 5.0?

  • I'm using a Putty (SSH Client) to create a SSL Tunnel to my linux firewall from the outside. Normally, it will enumulate the local port and forward to destination ip (That configure in the Putty client).

    So, I try to make a connection to localhost:3390 because I configure a Putty client to forward any connection from localhost:3390 to 192.168.0.1:3389 which is behind my firewall and accept for RDP connection. But the Vista RDP client report the error message "The client could not connect. You are already connected to the console of this computer. A new console session cannot be established.". What's up why I cannot do this. It's used to worked before in Windows XP environment?

    Does anybody can tell me why?

  • For more information about how to. Visit this URL http://www.hackszine.com/blog/archive/2007/05/how_to_remote_desktop_to_a_win.html

  • Pinai:

    Try forwarding from port 3391.  Port 3390 is used for Media Center Extender support, so RDP thinks you are trying to connect to your own machine and fails since you're already logged on.  Using a port other than 3389 and 3390 should fix this.

    Does this solve your problem?

  • Many thank Eric, It's worked!!!!..... ;)

  • Thanks Eric, my problem with error code - 0x80090330 is a mystery, in other words I'm clueless what caused it since the computers are in Lab learning environment and cannot document the countless changes everyday.  

    - But it started after a Cisco VPN ipsec isakmp tunnel lab I used for weeks the Vista as a VPN client, RDP was working fine during this time until I removed the VPN configurations on all the PCs, suddenly Vista was not accepting RDP.

    - Don't have time to figure out the logic of your miraculous solution [enablecredsspsupport:i:0] but it works and thank you very much

    Michael Rossell

    San Francisco, CA Cisco Nerd Central

  • Honestly I think Microsoft has totally lost touch with users in general and it shows in the stupid designs of the new RDP client and the stupid version of windows called Vista or to me a Piece of S***T

  • For the individual with this issue:

    “The authentication certificate received from the remote computer has expired or it not valid.”

    I had the same issue and couldn't find anything, but when you go to the remote computer that you are trying to connect to and delete the certificate (add Certificates via MMC) it should work, but first you should fix your time/date if that is the issue.  In my case, I changed the time back a year to get my VMWare Workstation 6 Trial to start back up so I could change some settings before upgrading.  After changing the time I noticed that I couldn't RDP from any of the other Vista boxes at my house, so I changed the time back and noticed that it still didn't work.  I found that the RDP certificate was generated and with the old Date and the box that I was connecting from was at the current date.  The current box saw that the certificate expired and refused the connection.  I just deleted the old certificate and then tried to re-connect from my other Vista box and a new certificate was issued and I was then able to connect.

    Cheers,

    Eric

  • Hi,

    I'm trying to connect via RemoteDesktop 6.0 to a Windows XP SP2 machine with a SmartCard but without success. Before the connection RemoteDesktop asked me the credentials. So I choosed the SmartCard info from the drop-down list and entered my PIN. Then I saw the normal Windows authentification screen. At this authentification page, I didn't have the option to choose the SmartCard user.

    BTW: The option Smart cards in Local Devices is enabled.

    Anyone has an idea?

    Thanks!!

    PRJ

  • Is there a Registy Value (not just a switch for saved RDP shortcuts) that we can use to globally disable the username/password pre-connection prompt?  We have always used biometrics through the session with 5.x and this is limiting the use of biometrics in our organization.

  • When I connect to my computer using RDC, I got a black screen and nothing happens after that. It looks like it's hanging.

  • “The authentication certificate received from the remote computer has expired or it not valid.”

    Thanks for the tip to check the computer time. For some reason or another, after a shutdown, Vista decided to set my system date to August 24, 2008 (it is June 4, 2007 currently).

    I agree with the person who posted about how one should try to make their points without a lot of crying. Definitely true. I guess where a lot of that is coming from is the frustration that people are seeing with Vista. It seems like with every turn, there is something else that doesn't work. In my 6 months or so using Vista I've seen:

    - my date get set into the future

    - the display on my laptop get scrambled (had to re-install Vista)

    - Office 2007 stop working (never quite figured out if this is a Vista or Office issue)

    - Camtasia not work with Vista

    - my HP printer not have networking drivers for Vista

    - my laptop not being able to hibernate and blue screen

    I understand that all of this isn't Microsoft's fault. I guess my complaint - and the complaints of many others I think - is that it just feels like 1992 all over again. Back then, it was a struggle to get your operating system running with all of your hardware and software. Maybe it is because I was younger then, but I didn't mind jumping through all the hoops to get things to work (i.e. asking friends, reading bulletin boards, calling various support desks, etc). Now, some 15 years later, I find myself doing the exact same thing with Vista. Shouldn't things have matured now? Maybe I'm spoiled but I just want things to work nowadays. I know it's a huge thing to ask, but as a consumer, I just expect Vista to work; just like I expect my car to start every time, my phone to work and my TV to turn on every time. The sad realization is that maybe Microsoft just can't do this. As a company, it has taken the industry very, very, very far in a relatively short period of time. But could it be that Microsoft simply can't take it any further? As I walk around coffee shops in my neighborhood, I see more and more people using Apple. I think it's sad since I've invested a lot of time with Microsoft, but maybe it is inevitable.

    Anyways, thanks for the information on this blog; after 3 hours or so, I can remotely log into my computer.

Page 7 of 17 (244 items) «56789»