1

Background: I trying to do a RDP login to a domain client (Win10) (client A) with a second client (Win10) (client B) while both a connected on a network without connection to the domain controller. But it fails without access to the domain controller, while other login methods work, see the following cases for details:

  1. logging into client A from client B via RDP with the domain account (without DC connection) fails
  2. logging into client A from client B via RDP with the domain account (with DC connection through a VPN on client A) works fine
  3. logging into client A locally/directly with the domain account (no RDP) works fine (without connection to the DC, using cached user account / domain credentials on client A)
  4. logging into client A from client B via RDP with a local user account works fine (without connection to the DC)
  5. logging into client A from client B via remote terminal works fine (without connection to the DC using cached user account/domain credentials on client A)

Eventviewer shows me the following entry in the security Windows log:

ID: 4625
Failure Reason: Unknown Username or bad Password

Question: Apparently there is a verification needed by the domain controller, which causes the problem. Is it possible to get RDP to use the credentials locally stored on client A (basically the same way I can logon in case 3 directly)?

Goal: In essence, I want to be able to login via RDP the same way I can login locally. I need to remotely continue the user session I started locally (in case no VPN could be established, if I locally logged on with cached credentials, the RDP needs to login with cashed credentials as well). Unfortunately, a third-party screen sharing application is not an option.

So far I haven't found any solution on the web, mostly because the search results were cluttered with other use cases (e.g. trying to RDP into the domain controller, etc.).

2 Answers 2

1

This is working as designed.

B needs to have some way to determine that the user-account supplied by A is legit.
Since it is a domain account the only authority that can do that is the domain itself (aka a DC for the domain).

If the user-account used by A has logged on to B before (when the domain was available) B may have retained a cached user-profile and cached credentials. In that case logging in from A while the domain isn't available may work (on basis of the cached credentials), but it is also possible that the domain-configuration (group-policy) has explicitly disabled that. It is common practice to do that.

Local accounts don't have this problem because their controlling authority is the computer on which they are defined (B in this case) which is available.

So it is all working as designed and there is no way around that.
And that is a good thing because if there was such a workaround every piece of malware in the world would exploit it to log into every computer it can reach over the network.

4
  • Thanks! The credentials are cached and valid (otherwise case #3, direct login without RDP wouldn't work). Can the group policy disable the login with cached credentials just for RDP but not for direct/local login? If so, which policy do I need to change?.
    – Albin
    Sep 30, 2020 at 10:01
  • PS. I'm not trying to argue that this is not a good design, I need to be able to login via RDP the same way I login locally (so I can remotely continue the session I started locally).
    – Albin
    Sep 30, 2020 at 10:22
  • @Alibin Well, if you can change the group-policies.... I never had any reason to mess with this. I'm not even sure if it can be done, but I would start with "Local Policies\Security Options" and the "User Rights Assignment" section. Probably requires a combination of multiple settings in those folders. You may need stuff from the Administrative Templates as well. I wouldn't know. For the security of your domains sake: It is usually not a good idea to mess with these things, unless you are absolutely certain you know what you are doing.
    – Tonny
    Sep 30, 2020 at 11:44
  • Thanks for your ideas. By know I had a little more success finding solutions searching for rdp login with cached domain credentials on the RDP server's host confirming my suspicion that it's a RDP-Server/Client problem (not a group policy problem). Accessing the remote machine via stored credentials works fine for other applications (e.g. for a remote terminal window, I can login with my domain credentials without problems it doesn't matter if client A has a connection to the DC or not).
    – Albin
    Sep 30, 2020 at 15:46
0

From Setting for remote desktop, click advanced setting, and uncheck "Requires computers to use Network Level Authentication to connect(recommended)" solved my issue.

1
  • 1
    Your answer could be improved with additional supporting information. Please edit to add further details, such as citations or documentation, so that others can confirm that your answer is correct. You can find more information on how to write good answers in the help center.
    – Community Bot
    Apr 13, 2023 at 18:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .