13

INFORMATION:

  • I have a situation where I am forced to use a server (Windows 2012 R2) that is NOT part of a domain, and does NOT have AD. This is not my choice, is not optimal, but out of my control.

  • I also have local users that connect to this server through RDP, and the local users have a password expiration policy.

  • Since AD/Exchange is not part of the picture, the users receive no notification that their passwords are about to expire.

PROBLEM: The problem is when a user's password has expired and they try to login using a Remote Desktop Connection. It does not allow them to change their password.

I have unchecked the "Allow connections ONLY from computers running Remote Desktop with Network Level Authentication" from the server side, so the server is NOT requiring NLA from incoming RDP sessions.

However, when using Windows Remote Desktop Connection Manager, it seems to be forcing NLA.

If I am using the "Terminals" Remote Desktop Client, there is an option on the client side, to disable using "Network Level Authentication". If I disable NLA through the Terminals client, and I connect to the server, it allows me to change the users expired password.

QUESTION: I am making the assumption, perhaps incorrectly, that the Terminals program is just sitting on top of Windows Remote Desktop Connection protocols, and that if you can disable Network Level Authentication client side through the Terminals program, then you should also be able to disable this through Windows built-in Remote Desktop Connection Manager. Unfortunately, I do not see this option in the connection managers GUI, and I do not see any parameters in ".RDP" files specific to NLA.

If I click "About" on the client side Remote Desktop Connection Manager, it tells me that "Network Level Authentication supported". The wording leads me to believe that using it is optional, but again, I see no way to turn it off in the connection manager. BTW, this particular connection manager is v10.

  • 1
    I edited your question (the title specifically) to focus on your underlying goal, instead of a proposed method of achieving the goal. See the XY problem. – Twisty Impersonator Apr 7 '17 at 16:02
12

You can solve this with a two pronged approach:

1. Install the RD Web Access role and enable the remote password change option

The following directions are from the woshub.com article Allow users to reset expired password via RD WebAccess in Windows Server 2012:

In Windows 2012 / 2012 R2 an option appeared that allows a remote user to change their password (current or an expired one) using a special web-page on the RD Web Access server. The password will be changed like this: a user signs in to the registration web page on the server with the RD Web Access role and changes his password using a special form.

A remote password change option is available on the server with the Remote Desktop Web Access (RD Web Access) role, but it is disabled by default. To change a password, a script password.aspx is used, which is located in C:\Windows\Web\RDWeb\Pages\en-US.

  1. To enable the password change option, on the server with the configured RD Web Access role open the IIS Manager console, go to [Server Name] –> Sites –> Default Web Site –> RDWeb –> Pages and open the section Application Settings.

    enter image description here

  2. In the right pane, find PasswordChangeEnabled parameter and change its value to true.

    enter image description here

  3. You can test the password change mechanism going to the following web-page:

    https://RDSServerName/RDWeb/Pages/en-US/password.aspx

    enter image description here

  4. Now when trying to connect to the RD Web Access server with the expired password, a user will be redirected to password.aspx web-page and offered to change his password.

    enter image description here

    Tip. The same Windows Server 2008 R2 feature can become available after you install a special patch — KB2648402.


2. Enable prompts notifying users of pending password expiration

  1. Run gpedit.msc on the RDSH server to open Local Group Policy
  2. Nagivate to Computer Configuration\Windows Settings\Local Policies\Security Options
  3. Edit the setting Interactive logon: Prompt user to change password before expiration and specify a reasonable number of days, such as 14.
  4. Users, including those logged in via Remote Desktop, will receive a notification prior to their password expiring.
  • Thanks @twisty, I should have mentioned that installing the Remote Desktop Server Role was also not an option. However, this is great information for someone else in a similar situation. The prompts is a good thing to know though! – guht Apr 7 '17 at 19:43
  • 3
    Then you have no choice but to disable NLA on the server and clients in order to permit them to change their password. Dangerously, this significantly reduces the security of the RDP connections. – Twisty Impersonator Apr 7 '17 at 19:48
9

It turns out this is controlled through an unlisted property in the .RDP configuration file called "enablecredsspsupport", by setting this to "0" it loads the login page in an RDP session, and allows a user to change their expired password.

The exact syntax needed in the .RDP configuration file is:

enablecredsspsupport:i:0

If you need further reference or reading go here: The Tyranny of Network Level Authentication and CredSSP

  • 3
    This works only if NLA is not required by the server. Otherwise, you'll get a message saying that network level support is required by the remote computer but not supported on the local computer. You should explain what this setting actually does, possibly citing a paragraph from the linked article. – simlev Aug 3 '17 at 15:39
  • Note: clicking the Save button in Remote Desktop Connection will create the config file Default.rdc. (Click the Save As button to see which directory the file is stored in.) That is the file to edit if you want this setting by default. Or you can put it in a different .RDP file that you open manually when you need it. – Bampfer May 31 '18 at 17:45
0

None of the options worked for me since I have NLA enabled. Here's a way to change it via PowerShell - full story on How to change your own expired password when you can’t login to RDP.

function Set-PasswordRemotely {
    [CmdletBinding()]
    param(
        [Parameter(Mandatory = $true)][string] $UserName,
        [Parameter(Mandatory = $true)][string] $OldPassword,
        [Parameter(Mandatory = $true)][string] $NewPassword,
        [Parameter(Mandatory = $true)][alias('DC', 'Server', 'ComputerName')][string] $DomainController
    )
    $DllImport = @'
[DllImport("netapi32.dll", CharSet = CharSet.Unicode)]
public static extern bool NetUserChangePassword(string domain, string username, string oldpassword, string newpassword);
'@
    $NetApi32 = Add-Type -MemberDefinition $DllImport -Name 'NetApi32' -Namespace 'Win32' -PassThru
    if ($result = $NetApi32::NetUserChangePassword($DomainController, $UserName, $OldPassword, $NewPassword)) {
        Write-Output -InputObject 'Password change failed. Please try again.'
    } else {
        Write-Output -InputObject 'Password change succeeded.'
    }
}

Simply run Set-PasswordRemotely and it will ask you 4 questions - username, old password, new password, domain controller and change the password for you. It works from non-domain joined PC as well. Requires connectivity to DC.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.