18

My W8 machine is connected to domain zen. If I rdp to the W8 machine, I can log in as a local user without problems. If I try to log in as a domain user, I am prompted for a smart card instead of a password.

Any ideas why?

Windows 8 RDP Smart Card prompt

Note that Interactive login: require smart card is disabled in group policy:

enter image description here

And here is the output from rsop.msc:

enter image description here

Some additional information on this one. If my connecting machine is on the same domain/network as the W8 machine, then I am prompted for a password as usual. If the machine is remote, on a different domain, then I am prompted for a smart card. In addition, the machine I am connecting from that gets the smartcard prompt is an XP box - so it may be an issue confined to mstsc.exe version 6.0.x - with 6.1 the authentication is managed prior to the rdp gui session being established.

I haven't isolated exactly which of these factors triggers the different response.

7
  • Where did you get that screen shot from? Are you sure the policy is being applied? Run rsop.msc on the target machine to get the "Resultant Set of Policy". Check to see if required logon is enabled or disabled when you do that. Oct 22, 2012 at 23:58
  • @ScottChamberlain Updated with the output from rsop. "Required Logon" isn't an option I can see, and require smart card is undefined. I would expect this to default to "require" if undefined. What policies is this a result of - it must be the local and domain group policies right? I don't have a domain level group policy.
    – Paul
    Oct 23, 2012 at 0:07
  • I meant to type "Require Smart Card" instead of "require login". But this is the effective policy on the computer adding together local computer polices, local user policies, domain computer polices, and domain user policies. When it is not defined it defaults to disabled. Also, was that RSOP screenshot from your computer or the server (when you are logged in as you)? Oct 23, 2012 at 0:26
  • Just for curiosity sake, see if you can logon as a local user, then do the RSOP in a run as ... as the domain user. Perhaps the setting is being applied on the domain user level, and if you ran rsop.msc on the local user level it would not pick up the setting. Oct 23, 2012 at 0:34
  • I don't think I can - mmc requires elevation, so if I runas the domain user, it tells me I need to elevate, which would then just run as administrator (the domain user is in the administrators group)
    – Paul
    Oct 23, 2012 at 0:47

7 Answers 7

8

I managed to bypass the problem by clicking on "other user". I was then able to enter my username and could enter a password.

7

I had exactly the same issue. No idea why it prompts for smartcard, but found 2 workarounds:

  1. use Linux RDP client (grdesktop) where you submit password before connection is made
  2. From XP, add /public to mstsc command line:

    mstsc /v a.b.c.d /public
    
0
4

You have to disable Interactive logon: require smart card in

Control Panel / Administrative Tools / Edit Group Policy / 
   Computer Configuration / Windows Settings / Security Settings / 
      Local Policies / Security Options

Note that these are server-side settings and so apply to the machine being connected to.

0
1

I realized that if I don't specify a username in the RDP connection and I use the IP address instead of the server's name, no smartcard is requested to login on the server.

0

Another thing you might look for is a program called "Bitguard". I started getting the Smart Card prompt when trying to access shared devices on my network. This was driving me crazy because every time I tried to disable it using Control Panel, I got a Windows Explorer crash or it was grayed out so I couldn't make the choice to use ID and Password. After much research, I read somewhere that a recently added program can cause this. I went to see what was recently installed and saw the culprit "Bitguard". As soon as that was uninstalled, I was able to access the network devices using ID and password with no other changes to my system.

0

I've had this issue, and can confirm that if you change your remote desktop client's login username to \, it logs in just fine to the currently logged in session and doesn't prompt for the smart card anymore. This was with Remote Desktop Connection for Mac.

0

I found that adding the -p - option to the command line solved the problem, e.g.

rdesktop machine.domain.com -u user -p -

When I use an invocation like that it'll then ask for a password in the terminal before starting the RDP session, then log in without asking for a smart card.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .