3

I'm running Windows 10 and I'm trying to access a different Windows 10 machine via RDP. I saved the RDP file to include saving the credentials. Unfortunately for some machines this does not work. The username gets saved correctly but when I start the connection the first time without entering the credentials the login fails.

A login prompt is shown instead with the correct domain/username, with the error message that the login attempt failed. If I put in the password now the RDP connection is established correctly. Deleting the saved user credentials and trying to save them again results in the same problem. Even if I activate the check box "saved credentials", the next time I try to, it's back to the same problem.

I didn't discover any solution yet that would resolve the issue, any ideas?

7
  • Are you by chance using the same username for both machines?
    – Ramhound
    Dec 14, 2021 at 21:37
  • yes, it's a domain account (but note, it works fine on other machines with the same version/build)
    – Albin
    Dec 14, 2021 at 21:39
  • You are specifying the domain and the user when you attempt to login into the machine? What exactly is different about those machines that don't seem to work?
    – Ramhound
    Dec 14, 2021 at 21:43
  • with the login? nothing, just different IPs (same subnet)
    – Albin
    Dec 14, 2021 at 21:53
  • No; I know the logins are identical since you indicated you are connected to an AD domain. I am asking what is similar to those machines that are not working compared to the machines that are working. Wondering what the delta is between the machines that are not working and the machines that are working.
    – Ramhound
    Dec 14, 2021 at 22:10

1 Answer 1

5

Changing a GPO did the trick: on the client you are using to connect to the remote machine (not on the remote machine!):

  • open gpedit.msc

  • goto Local Computer Policy > Computer Configuration > Administrative Templates > System > Credentials Delegation.

  • change the policy named “Allow delegating saved credentials with NTLM-only server authentication” to active

  • add all remote computers to the list by adding TERMSRV/* (you can specify single machines and domains as well, see link)

  • force a policy update by executing gpupdate /force

here's a good article about it with a few additional options.

Note: activating the policy named Allow delegating saved credentials wasn't necessary in my case

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .