6

On XP, the Guest account can run the RDP client to connect to a remote RDP server, but when I try the same under Vista Business (with all updates installed) I get this:

Error

I can run mstsc manually with 'Run' on the Start Menu, but although it runs, nothing happens at all when I click 'connect'.

Everything works fine logged in as any other account, it only fails as 'Guest', and this is on multiple clean installs of Vista.

Is there something in the Local Policy that can be tweaked to allow the RDP client as Guest?


edit: there is also a message in the rdp client itself:

enter image description here

and I get this error when trying rdp+:

enter image description here

15
  • 1
    no, it's standalone and literally just clean-installed with Vista
    – user84636
    Dec 14, 2014 at 8:09
  • 1
    @Caleb ha ha, yes, these are cast-off PCs from someones upgrade cycle - we wipe them and lock them down as RDP terminals. It's been XP up till now, but we are starting to get Vista too...
    – user84636
    Dec 18, 2014 at 14:42
  • 2
    @Caleb I went down that route a couple of years ago and gave up - things like local printer support/redirection and support for random video cards and random resolutions were the stumbling blocks at the time iirc.
    – user84636
    Dec 18, 2014 at 15:19
  • 1
    @Twisty it's Vista Business SP1, and I used the full install iso (retail and OEM are the same afaik with Vista, just different keys). I have not installed any updates (and probably should, at least to see if it makes any difference).
    – user84636
    Dec 22, 2014 at 7:57
  • 1
    @Twisty installed all updates and no change - I've given up and gone another route!
    – user84636
    Dec 23, 2014 at 12:49

3 Answers 3

1

I've given up trying to find a solution and I'm using a workaround instead. Seeing as these machines are locked down and only required to run Remote Desktop Client, I'm comfortable with this being a bit of a hack:

  1. Create normal (limited) user called MYUSER (or whatever)
  2. Set everything up in the profile the it needs to be (eg link to .rdp file)
  3. As admin, copy C:\Users\MYUSER\NTUSER.DAT to C:\Users\Default (overwrite destination)
  4. Rename C:\Users\MYUSER\NTUSER.DAT to C:\Users\DASH\MYUSER.DAT.MAN

Basically this forces a temporary profile to be used on every login, and this profile comes from C:\Users\Default. The effect is that any changes a user makes while logged in are discarded when logging out.

1
0

I can't replicate this situation but please, try this:

Local Security Policy -> Applicatio Control Policies -> AppLocker -> Executable Rules -> Create new rule...

Create rule exception for Guest to lunch %SYSTEM32%\mstsc.exe file.

2
  • 1
    I'll try this but there is nothing showing in the Event Log to indicate it's being blocked by SoftWare Restrictions (it's Vista, so no AppLocker)
    – user84636
    Dec 18, 2014 at 14:14
  • @jack-douglas yeah, that's why I can't test it. I've got 7.
    – Diodak
    Dec 18, 2014 at 14:15
0

To allow Guest to use remote logon, one needs to add the Guest account to the Remote Desktop Users group, as described in the article Configure the Remote Desktop Users Group.

  1. Start the Control Panel -> System
  2. Click the Remote tab
  3. Under "Remote Desktop" click the "Select Users..." button
  4. Click Advanced
  5. Click Find now
  6. Scroll down and double-click on Guest
  7. Click OK all the way out

Giving these permissions to the Guest account may be a security risk.


Another idea: Try to sign the .rdp file with a trusted certificate.

7
  • 4
    Doesn't this allow the Guest user to log in to the PC via RDP rather than allowing the guest user to RDP to an external server?
    – user84636
    Dec 18, 2014 at 17:18
  • One may need to do it on both server and client, and there may be other permissions that Guest may need. AFAIK no one has ever tried to do this before with Guest, so I cannot guarantee that this will work. But it's a start.
    – harrymc
    Dec 18, 2014 at 17:24
  • We won't be enabling Guest access on the server (for what I hope are obvious reasons) - but note that the error message on the client comes before any connection attempt - even launching the .RDP file is prevented.
    – user84636
    Dec 18, 2014 at 17:26
  • Have you tried adding Guest to this group on the client? (No way that I'll be trying this at the office.)
    – harrymc
    Dec 18, 2014 at 17:30
  • I have now - and it makes no difference I'm afraid.
    – user84636
    Dec 18, 2014 at 17:41

You must log in to answer this question.