Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

How to i allow credentials to be saved when connecting to another machine with Remote Desktop Connection?

Background

i try to connect to a server, and the Remote Desktop Client does not have any saved credentials:

enter image description here

In order to try to save the credentials i check the option Allow me to save credentials:

enter image description here

i then initiate the connection, enter my password, and notice that the Remember my credentials option is checked:

enter image description here

Once connected to the server, i ensure that the local group policy options

Local Computer Policy ➞ Computer Configuration ➞ Administrative Templates ➞ Windows Components ➞ Remote Desktop Services ➞ Remote Desktop Connection Client

  • Prompt for credentials on the client computer
  • Do not allow passwords to be saved

which default to allowing passwords to be saved, and default to not prompting for credentials, are forced to allow passwords to be saved, and forced to not prompt for passwords:

enter image description here

And i run gpupdate /force to ensure the forced off security settings are in use.

Repeat the above steps 4 or 5 times, on the 6th time creating screenshots for a stackoverflow question.

Notice that Remote Desktop Connection client refuses to save my password, noting:

You will be asked for your credentials when you connect

enter image description here

So the question is: How do save credentials when connecting to a machine?

Additional things tried

As was suggested:

i tried enabling the "Allow delegating saved credentials with NTLM-only server authentication" for TERMSRV/* in gpedit.msc on the client (e.g. Windows 7) machine:

enter image description here

People suggest this without realizing that it only applies to NTLM authentication. NTLM is an outdated, insecure, and should not be used:

NTLM is an outdated authentication protocol with flaws that potentially compromise the security of applications and the operating system. Although Kerberos has been available for many years many applications are still written to use NTLM only. This needlessly reduces the security of applications.

Either way: it didn't work.

Bonus information

  • tried both modern ian@avatopia.com and legacy avatopia.com\ian username formats
  • tried setting the group policy on the domain controller
  • Windows 7 64-bit Professional client
  • Windows Server 2008 R2 server
  • Windows Server 2008 server
  • Windows Server 2012 server
  • Windows Server 2003 R2 server
  • everything from Background on is just filler to make it look like i "attempted some research effort"; you can ignore it; including this line which talks about ignoring this line

Appendix A

The client is Windows 7, connecting to Windows Server 2008 R2, over RDP 7.1, with the server using an auto-generated certificate:

enter image description here

The client has authenticated the identity of the server:

enter image description here

It also happens when connecting to Windows Server 2008, and Windows Server 2012 (all from Windows 7 client). All machine are joined to the same domain.

Appendix B

The resultant set of policy (rsop.msc) on the client has Always prompt for password on connect set to Disabled:

enter image description here

Appendix C

Results of connecting to every server i can find. i was wrong when i said it fails on any connection to Server 2003. The problem is limited to Server 2008, 2008 R2, and 2012:

  • Windows Server 2000: Yes*
  • Windows Server 2000: Yes*
  • Windows Server 2003: Yes
  • Windows Server 2003 R2: Yes
  • Windows Server 2003 R2: Yes (Domain controller)
  • Windows Server 2003 R2: Yes
  • Windows Server 2008: No
  • Windows Server 2008: No
  • Windows Server 2008 R2: No
  • Windows Server 2008 R2: No
  • Windows Server 2012: No
  • Windows Server 2012: No

*indicates it will use saved credentials, but must re-enter password at 2000 login screen

Bonus Reading

share|improve this question
    
If you go to Server Manager -> Roles -> Remote Desktop Services -> RD Session Host Configuration then double click on the connection (likely called 'RDP-Tcp`) what is set for the Certificate on the general tab? I have had issues in the past where if the client did not respect the certificate it would not save the credentials. –  Scott Chamberlain Jun 10 '13 at 15:47
    
Also the GP settings you show in your screenshot are client side settings. Check the what the setting is set to on the client connecting to the server. (use rsop.msc to quickly see what the policy settings are set to on the client) –  Scott Chamberlain Jun 10 '13 at 15:54
    
Are you using RDP 8 ? Is this all happening on one domain, or more ? –  harrymc Jun 10 '13 at 16:16
    
@ScottChamberlain Added screenshot. The general tab says the certificate is "Auto generated". –  Ian Boyd Jun 10 '13 at 16:50
    
Is the client and server in the same domain? –  Scott Chamberlain Jun 10 '13 at 17:03
show 7 more comments

6 Answers

up vote 7 down vote accepted

i found the solution. It was at the same time both subtle, and obvious.

As mentioned in the question, when i was modifying the following Remote Desktop Connection Client Group Policy settings:

  • Prompt for credentials on the client computer
  • Do not allow passwords to be saved

i was checking them on the server:

enter image description here

i thought it would be the server that dictates what the client is allowed to do. Turns out that is completely wrong. It was @mpy's answer (while incorrect), which led me to the solution. i shouldn't be looking at the RDP client policy on the RDP server, i need to look at the RDP client policy on my RDP client machine:

enter image description here

On my client Windows 7 machine, the policy was:

  • Do not allow passwords to be saved: Enabled
  • Prompt for credentials on the client computer: Enabled

i do not know when these options were enabled (i did not enable them in recent memory). The confusing part is that even though

Do not allow passwords to be saved

is Enabled, the RDP client would still save password; but only for servers below Windows Server 2008.

The truth table of functioning:

Do not allow saved  Prompt for creds  Works for 2008+ servers  Works for 2003 R2- servers
==================  ================  =======================  ==========================
Enabled             Enabled           No                       Yes
Enabled             Not Configured    No                       No
Not Configured      Enabled           Yes                      Yes
Not Configured      Not Configured    Yes                      Yes

So there is the trick. The group policy settings under:

Computer Configuration\Policies\Administrative Templates\Windows Components\Terminal Services\Remote Desktop Connection Client

on the client machine need to be configured with:

  • Do not allow passwords to be saved: Not Configured (critical)
  • Prompt for credentials on the client computer: Not Configured

The other source of confusion is that while

  • a domain Enabled policy cannot override a local Disabled
  • a domain Disabled policy can be overridden by a local Enabled policy

Which again leads to a truth table:

Domain Policy   Local Policy    Effective Policy
==============  ==============  ==============================
Not Configured  Not Configured  Not configured (i.e. disabled)
Not Configured  Disabled        Disabled
Not Configured  Enabled         Enabled
Disabled        Not Configured  Disabled
Disabled        Disabled        Disabled
Disabled        Enabled         Disabled (client wins)
Enabled         Not Configured  Enabled
Enabled         Disabled        Enabled (domain wins)
Enabled         Enabled         Enabled
share|improve this answer
add comment

The most detailed answer is already there, made by asker. I only want to note that this problem may also happen when client computer OS is a home SKU, thus no local GP editor may be available, neither a domain policy is in effect. Nevertheless, the client may act as if the policy to always ask password is set (don't know what causes such a default - maybe some program installed?).

Then, it is useful to set the policy registry setting manually (MS RDP client checks it; you may find it using a tool like procmon). It is here:

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services]

"PromptForCredsOnClient"=dword:00000000

"DisablePasswordSaving"=dword:00000000
share|improve this answer
add comment

Reading through your questions, I stumbled over this Group Policy setting: Prompt for credentials on the client computer which you disabled.

MS Technet gives the following explanation on this setting:

Prompt for credentials on the client computer

This policy setting determines whether a user will be prompted on the client computer to provide credentials for a remote connection to a terminal server.

If you enable this policy setting, a user will be prompted on the client computer—instead of on the terminal server—to provide credentials for a remote connection to a terminal server. If saved credentials for the user are available on the client computer, the user will not be prompted to provide credentials.

Note If you enable this policy setting and a user is prompted on both the client computer and on the terminal server to provide credentials, run the Terminal Services Configuration tool on the terminal server, and in the Properties dialog box for the connection, clear the Always prompt for password check box on the Log on Settings tab.

If you disable or do not configure this policy setting, the version of the operating system on the terminal server will determine when a user is prompted to provide credentials for a remote connection to a terminal server. For Windows 2000 and Windows Server 2003, a user will be prompted on the terminal server to provide credentials for a remote connection. For Windows Server 2008, a user will be prompted on the client computer to provide credentials for a remote connection.

That sound exactly to be the scenario you are facing. You want to save the credentials on the client machine, so just enable the Prompt for credentials on the client computer setting.

share|improve this answer
add comment

Since the direct answer to the question is already there, I'will suggest an alternative approach.

Remote Desktop Connection Manager (RDCMan) is a tool written by Julian Burger and used internally in Microsoft. It's very lightweight and free and in my opinion it greatly improves productivity, especially when you maintain many connections. And yes, it stores passwords too (in xml configuration file).

Advantages:

  • You can organize connections in hierarchies, which inherit properties (e.g. credentials, color settings, resolution)
  • All configuration, including hashed passwords, stored in one file - easy to move between computers
  • Lightweight, free, reliable

Disadvantages:

  • Some people don't like the navigation menu on the left when not in full screen mode. Personally, I got used to it quickly.

Remote desktop connection manager

Screenshot from the article:
How Sysadmins RDP efficiently using Remote Desktop Connection Manager

share|improve this answer
add comment

I suggest using using Royal TS that does credential management much better than the mess that Microsoft's RDP does of it.

The latest version is commercial, starting at $35 for the individual license.

Or you can opt for Version 1.5.1, which is the last freeware version, that looks quite sufficient to do the job.

share|improve this answer
    
Unfortunately RoyalTS doesn't handle full-screen, 32-bit color, is a separate download. And switching to another client doesn't solve the problem in this client. –  Ian Boyd Jun 11 '13 at 13:54
    
The freeware version supports full-screen, but in 24-bit. If that's not enough, perhaps the newer commercial version (trial available) can do better. –  harrymc Jun 11 '13 at 14:26
    
If i did own RoyalTS: my question still stands. Especially for people who are have never been able to solve this problem for the last five years; and came to SuperUser hoping for a solution. –  Ian Boyd Jun 11 '13 at 14:32
add comment

just a wild guess, but: Have you tried to save the default.rdp file after you checked the "Remember my credentials" box?

Good luck, Eelco

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.