43

How to i allow credentials to be saved when connecting to another machine with Remote Desktop Connection?

Background

i try to connect to a server, and the Remote Desktop Client does not have any saved credentials:

enter image description here

In order to try to save the credentials i check the option Allow me to save credentials:

enter image description here

i then initiate the connection, enter my password, and notice that the Remember my credentials option is checked:

enter image description here

Once connected to the server, i ensure that the local group policy options

Local Computer Policy ➞ Computer Configuration ➞ Administrative Templates ➞ Windows Components ➞ Remote Desktop Services ➞ Remote Desktop Connection Client

  • Prompt for credentials on the client computer
  • Do not allow passwords to be saved

which default to allowing passwords to be saved, and default to not prompting for credentials, are forced to allow passwords to be saved, and forced to not prompt for passwords:

enter image description here

And i run gpupdate /force to ensure the forced off security settings are in use.

Repeat the above steps 4 or 5 times, on the 6th time creating screenshots for a stackoverflow question.

Notice that Remote Desktop Connection client refuses to save my password, noting:

You will be asked for your credentials when you connect

enter image description here

So the question is: How do save credentials when connecting to a machine?

Additional things tried

As was suggested:

i tried enabling the "Allow delegating saved credentials with NTLM-only server authentication" for TERMSRV/* in gpedit.msc on the client (e.g. Windows 7) machine:

enter image description here

People suggest this without realizing that it only applies to NTLM authentication. NTLM is an outdated, insecure, and should not be used:

NTLM is an outdated authentication protocol with flaws that potentially compromise the security of applications and the operating system. Although Kerberos has been available for many years many applications are still written to use NTLM only. This needlessly reduces the security of applications.

Either way: it didn't work.

Bonus information

  • tried both modern [email protected] and legacy avatopia.com\ian username formats
  • tried setting the group policy on the domain controller
  • Windows 7 64-bit Professional client
  • Windows Server 2008 R2 server
  • Windows Server 2008 server
  • Windows Server 2012 server
  • Windows Server 2003 R2 server
  • everything from Background on is just filler to make it look like i "attempted some research effort"; you can ignore it; including this line which talks about ignoring this line

Appendix A

The client is Windows 7, connecting to Windows Server 2008 R2, over RDP 7.1, with the server using an auto-generated certificate:

enter image description here

The client has authenticated the identity of the server:

enter image description here

It also happens when connecting to Windows Server 2008, and Windows Server 2012 (all from Windows 7 client). All machine are joined to the same domain.

Appendix B

The resultant set of policy (rsop.msc) on the client has Always prompt for password on connect set to Disabled:

enter image description here

Appendix C

Results of connecting to every server i can find. i was wrong when i said it fails on any connection to Server 2003. The problem is limited to Server 2008, 2008 R2, and 2012:

  • Windows Server 2000: Yes*
  • Windows Server 2000: Yes*
  • Windows Server 2003: Yes
  • Windows Server 2003 R2: Yes
  • Windows Server 2003 R2: Yes (Domain controller)
  • Windows Server 2003 R2: Yes
  • Windows Server 2008: No
  • Windows Server 2008: No
  • Windows Server 2008 R2: No
  • Windows Server 2008 R2: No
  • Windows Server 2012: No
  • Windows Server 2012: No

*indicates it will use saved credentials, but must re-enter password at 2000 login screen

Bonus Reading

14
  • If you go to Server Manager -> Roles -> Remote Desktop Services -> RD Session Host Configuration then double click on the connection (likely called 'RDP-Tcp`) what is set for the Certificate on the general tab? I have had issues in the past where if the client did not respect the certificate it would not save the credentials. Jun 10, 2013 at 15:47
  • Also the GP settings you show in your screenshot are client side settings. Check the what the setting is set to on the client connecting to the server. (use rsop.msc to quickly see what the policy settings are set to on the client) Jun 10, 2013 at 15:54
  • Are you using RDP 8 ? Is this all happening on one domain, or more ?
    – harrymc
    Jun 10, 2013 at 16:16
  • @ScottChamberlain Added screenshot. The general tab says the certificate is "Auto generated".
    – Ian Boyd
    Jun 10, 2013 at 16:50
  • Is the client and server in the same domain? Jun 10, 2013 at 17:03

9 Answers 9

18

i found the solution. It was at the same time both subtle, and obvious.

As mentioned in the question, when i was modifying the following Remote Desktop Connection Client Group Policy settings:

  • Prompt for credentials on the client computer
  • Do not allow passwords to be saved

i was checking them on the server:

enter image description here

i thought it would be the server that dictates what the client is allowed to do. Turns out that is completely wrong. It was @mpy's answer (while incorrect), which led me to the solution. i shouldn't be looking at the RDP client policy on the RDP server, i need to look at the RDP client policy on my RDP client machine:

enter image description here

On my client Windows 7 machine, the policy was:

  • Do not allow passwords to be saved: Enabled
  • Prompt for credentials on the client computer: Enabled

i do not know when these options were enabled (i did not enable them in recent memory). The confusing part is that even though

Do not allow passwords to be saved

is Enabled, the RDP client would still save password; but only for servers below Windows Server 2008.

The truth table of functioning:

Do not allow saved  Prompt for creds  Works for 2008+ servers  Works for 2003 R2- servers
==================  ================  =======================  ==========================
Enabled             Enabled           No                       Yes
Enabled             Not Configured    No                       No
Not Configured      Enabled           Yes                      Yes
Not Configured      Not Configured    Yes                      Yes

So there is the trick. The group policy settings under:

Computer Configuration\Policies\Administrative Templates\Windows Components\Terminal Services\Remote Desktop Connection Client

on the client machine need to be configured with:

  • Do not allow passwords to be saved: Not Configured (critical)
  • Prompt for credentials on the client computer: Not Configured

The other source of confusion is that while

  • a domain Enabled policy cannot override a local Disabled
  • a domain Disabled policy can be overridden by a local Enabled policy

Which again leads to a truth table:

Domain Policy   Local Policy    Effective Policy
==============  ==============  ==============================
Not Configured  Not Configured  Not configured (i.e. disabled)
Not Configured  Disabled        Disabled
Not Configured  Enabled         Enabled
Disabled        Not Configured  Disabled
Disabled        Disabled        Disabled
Disabled        Enabled         Disabled (client wins)
Enabled         Not Configured  Enabled
Enabled         Disabled        Enabled (domain wins)
Enabled         Enabled         Enabled
1
  • 1
    In Windows 10 the location is Computer Configuration\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Connection Client.
    – Marc.2377
    Apr 16, 2019 at 19:11
12
+75

Since the direct answer to the question is already there, I'll suggest an alternative approach.

Remote Desktop Connection Manager (RDCMan) is a tool written by Julian Burger and used internally in Microsoft. It's very lightweight and free and in my opinion it greatly improves productivity, especially when you maintain many connections. And yes, it stores passwords too (in xml configuration file).

Remote desktop connection manager

Advantages:

  • You can organize connections in hierarchies, which inherit properties (e.g. credentials, color settings, resolution).
  • All configuration, including hashed passwords, is stored in one file - easy to move between computers.
  • Lightweight, free, reliable.

Disadvantages:

  • Some people don't like the navigation menu on the left when not in full screen mode. Personally, I got used to it quickly.
  • It seems not to handle non-standard DPI settings well. For example, when I use the 125% zoom in Windows display settings and I find in RDP connections is a bit blurry. For that reason, on some machines I use Microsoft Remote Desktop instead. It handles this situation better.

Screenshot from the article:
How Sysadmins RDP efficiently using Remote Desktop Connection Manager

2
  • For lack of reason/real answer (gpolicy is fine on both of mine) this serves. And more specifically: it works. It stopped asking for passwords twice. (once via host (win7 saved password rdp entry) and once via remote (server 2012r2) even though I'm already logged in - just dc'd)
    – B. Shea
    May 22, 2018 at 16:06
  • I don't know how I've never used this before. I use RDP DAILY on numerous servers. This is a productivity saver! WOW. Thank you!
    – ScottN
    Sep 26, 2019 at 0:50
6

The most detailed answer is already there, made by asker. I only want to note that this problem may also happen when client computer OS is a home SKU, thus no local GP editor may be available, neither a domain policy is in effect. Nevertheless, the client may act as if the policy to always ask password is set (don't know what causes such a default - maybe some program installed?).

Then, it is useful to set the policy registry setting manually (MS RDP client checks it; you may find it using a tool like procmon). It is here:

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services]

"PromptForCredsOnClient"=dword:00000000

"DisablePasswordSaving"=dword:00000000
3

Reading through your questions, I stumbled over this Group Policy setting: Prompt for credentials on the client computer which you disabled.

MS Technet gives the following explanation on this setting:

Prompt for credentials on the client computer

This policy setting determines whether a user will be prompted on the client computer to provide credentials for a remote connection to a terminal server.

If you enable this policy setting, a user will be prompted on the client computer—instead of on the terminal server—to provide credentials for a remote connection to a terminal server. If saved credentials for the user are available on the client computer, the user will not be prompted to provide credentials.

Note If you enable this policy setting and a user is prompted on both the client computer and on the terminal server to provide credentials, run the Terminal Services Configuration tool on the terminal server, and in the Properties dialog box for the connection, clear the Always prompt for password check box on the Log on Settings tab.

If you disable or do not configure this policy setting, the version of the operating system on the terminal server will determine when a user is prompted to provide credentials for a remote connection to a terminal server. For Windows 2000 and Windows Server 2003, a user will be prompted on the terminal server to provide credentials for a remote connection. For Windows Server 2008, a user will be prompted on the client computer to provide credentials for a remote connection.

That sound exactly to be the scenario you are facing. You want to save the credentials on the client machine, so just enable the Prompt for credentials on the client computer setting.

3

In my case, the issue was that the *.rdp file downloaded from Microsoft Azure had the following line:

prompt for credentials:i:1

Normally checking 'save credentials' would change that line, but for some reason it also comes marked as 'read-only'.


Unmarking it as 'read-only' and changing the line to

prompt for credentials:i:0

in notepad fixed the issue.

1
  • This was driving me crazy, I had to keep looking up passwords and probably wasted several hours over the last year. No idea why they do this. Thanks!
    – makhdumi
    Jun 6, 2016 at 17:49
2

I've tried all possible options and nothing help. I have resolved the issue by resetting the password that is stored in Windows Vault for RDP connection.

Steps to do:

  1. Right click on RDP connection icon => Edit
  2. Select "Always ask for credentials"
  3. Connect. Input the right password and select "Remember my credentials"

That's all.

PS: The problem was caused by some Windows update.

0
0

I suggest using using Royal TS that does credential management much better than the mess that Microsoft's RDP does of it.

The latest version is commercial, starting at $35 for the individual license.

Or you can opt for Version 1.5.1, which is the last freeware version, that looks quite sufficient to do the job.

6
  • Unfortunately RoyalTS doesn't handle full-screen, 32-bit color, is a separate download. And switching to another client doesn't solve the problem in this client.
    – Ian Boyd
    Jun 11, 2013 at 13:54
  • The freeware version supports full-screen, but in 24-bit. If that's not enough, perhaps the newer commercial version (trial available) can do better.
    – harrymc
    Jun 11, 2013 at 14:26
  • If i did own RoyalTS: my question still stands. Especially for people who are have never been able to solve this problem for the last five years; and came to SuperUser hoping for a solution.
    – Ian Boyd
    Jun 11, 2013 at 14:32
  • Don't 'advertise' paid or shareware products.This does not answer the question and these types of 'answers' get quite annoying.
    – B. Shea
    May 22, 2018 at 15:37
  • RDCMan is adequate without getting into paid or crippled/lite/shareware 'free' software. So why add this? Try superuser.com/a/606433/47628 - completely free.
    – B. Shea
    May 22, 2018 at 16:08
0

Don't know why, but this worked:

(Using Windows 7 Home Basic)  I did not preconfigure my username in the Remote Desktop Connection options window. Instead, I connected to the remote host and waited for the credentials (Windows Security) prompt. And then I gave the credentials (username and password) and checked the option to remember my credentials.

There is no group policy editor for Windows 7 Home Basic. Also, RDCMan (as suggested in another answer) did not help.

1
0

What worked for me was what is suggested in the Stack Overflow question you referred to. (https://stackoverflow.com/q/11847805/4330815) Not sure why it didn't work for you without that additional changes you mentioned, but according to what you wrote I guess you modified only 1 setting out of the 4 (the "Allow delegating saved credentials with NTLM-only server authentication" one) Either way thanks a lot for the details you provided.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .