Windows 7 Remote Desktop Connection Save Credentials not working

Question

How to i allow credentials to be saved when connecting to another machine with Remote Desktop Connection?

Background

i try to connect to a server, and the Remote Desktop Client does not have any saved credentials:

In order to try to save the credentials i check the option Allow me to save credentials:

i then initiate the connection, enter my password, and notice that the Remember my credentials option is checked:

Once connected to the server, i ensure that the local group policy options

Local Computer Policy ➞ Computer Configuration ➞ Administrative Templates ➞ Windows Components ➞ Remote Desktop Services ➞ Remote Desktop Connection Client

• Prompt for credentials on the client computer
• Do not allow passwords to be saved

which default to allowing passwords to be saved, and default to not prompting for credentials, are forced to allow passwords to be saved, and forced to not prompt for passwords:

And i run gpupdate /force to ensure the forced off security settings are in use.

Repeat the above steps 4 or 5 times, on the 6th time creating screenshots for a stackoverflow question.

Notice that Remote Desktop Connection client refuses to save my password, noting:

You will be asked for your credentials when you connect

So the question is: How do save credentials when connecting to a machine?

Additional things tried

As was suggested:

• in the (closed) Stackoverflow question
• the Microsoft forum post

i tried enabling the "Allow delegating saved credentials with NTLM-only server authentication" for TERMSRV/* in gpedit.msc on the client (e.g. Windows 7) machine:

People suggest this without realizing that it only applies to NTLM authentication. NTLM is an outdated, insecure, and should not be used:

NTLM is an outdated authentication protocol with flaws that potentially compromise the security of applications and the operating system. Although Kerberos has been available for many years many applications are still written to use NTLM only. This needlessly reduces the security of applications.

Either way: it didn't work.

Bonus information

• tried both modern [email protected] and legacy avatopia.com\ian username formats
• tried setting the group policy on the domain controller
• Windows 7 64-bit Professional client
• Windows Server 2008 R2 server
• Windows Server 2008 server
• Windows Server 2012 server
• Windows Server 2003 R2 server
• everything from Background on is just filler to make it look like i "attempted some research effort"; you can ignore it; including this line which talks about ignoring this line

Appendix A

The client is Windows 7, connecting to Windows Server 2008 R2, over RDP 7.1, with the server using an auto-generated certificate:

The client has authenticated the identity of the server:

It also happens when connecting to Windows Server 2008, and Windows Server 2012 (all from Windows 7 client). All machine are joined to the same domain.

Appendix B

The resultant set of policy (rsop.msc) on the client has Always prompt for password on connect set to Disabled:

Appendix C

Results of connecting to every server i can find. i was wrong when i said it fails on any connection to Server 2003. The problem is limited to Server 2008, 2008 R2, and 2012:

• Windows Server 2000: Yes*
• Windows Server 2000: Yes*
• Windows Server 2003: Yes
• Windows Server 2003 R2: Yes
• Windows Server 2003 R2: Yes (Domain controller)
• Windows Server 2003 R2: Yes
• Windows Server 2008: No
• Windows Server 2008: No
• Windows Server 2008 R2: No
• Windows Server 2008 R2: No
• Windows Server 2012: No
• Windows Server 2012: No

^*indicates it will use saved credentials, but must re-enter password at 2000 login screen

Bonus Reading

• KB281262: How To Turn On Remote Desktop Automatic Logon in Windows XP
• SuperUser: Remote Desktop connection is ignoring saved credentials
• Windows Seven Forums: Windows 7: Remote Desktop Connection Automatic Log On - Allow or Prevent
• Microsoft.com: Saving and changing logon credentials in Remote Desktop Connection
• Microsoft.com: Saving your logon credentials in Remote Desktop Connection
• MSDN Remote Desktop Services Blog: Saved credentials do not work
• Stackoverflow: Windows 7 Remote Desktop Connection Save Credentials not working [closed]
• Microsoft Forums: Remote Desktop Connection not using saved credentials

Answer 1

i found the solution. It was at the same time both subtle, and obvious.

As mentioned in the question, when i was modifying the following Remote Desktop Connection Client Group Policy settings:

• Prompt for credentials on the client computer
• Do not allow passwords to be saved

i was checking them on the server:

i thought it would be the server that dictates what the client is allowed to do. Turns out that is completely wrong. It was @mpy's answer (while incorrect), which led me to the solution. i shouldn't be looking at the RDP client policy on the RDP server, i need to look at the RDP client policy on my RDP client machine:

On my client Windows 7 machine, the policy was:

• Do not allow passwords to be saved: Enabled
• Prompt for credentials on the client computer: Enabled

i do not know when these options were enabled (i did not enable them in recent memory). The confusing part is that even though

Do not allow passwords to be saved

is Enabled, the RDP client would still save password; but only for servers below Windows Server 2008.

The truth table of functioning:

Do not allow saved  Prompt for creds  Works for 2008+ servers  Works for 2003 R2- servers
==================  ================  =======================  ==========================
Enabled             Enabled           No                       Yes
Enabled             Not Configured    No                       No
Not Configured      Enabled           Yes                      Yes
Not Configured      Not Configured    Yes                      Yes

So there is the trick. The group policy settings under:

Computer Configuration\Policies\Administrative Templates\Windows Components\Terminal Services\Remote Desktop Connection Client

on the client machine need to be configured with:

• Do not allow passwords to be saved: Not Configured (critical)
• Prompt for credentials on the client computer: Not Configured

The other source of confusion is that while

• a domain Enabled policy cannot override a local Disabled
• a domain Disabled policy can be overridden by a local Enabled policy

Which again leads to a truth table:

Domain Policy   Local Policy    Effective Policy
==============  ==============  ==============================
Not Configured  Not Configured  Not configured (i.e. disabled)
Not Configured  Disabled        Disabled
Not Configured  Enabled         Enabled
Disabled        Not Configured  Disabled
Disabled        Disabled        Disabled
Disabled        Enabled         Disabled (client wins)
Enabled         Not Configured  Enabled
Enabled         Disabled        Enabled (domain wins)
Enabled         Enabled         Enabled

Answer 2

Since the direct answer to the question is already there, I'll suggest an alternative approach.

Remote Desktop Connection Manager (RDCMan) is a tool written by Julian Burger and used internally in Microsoft. It's very lightweight and free and in my opinion it greatly improves productivity, especially when you maintain many connections. And yes, it stores passwords too (in xml configuration file).

Advantages:

• You can organize connections in hierarchies, which inherit properties (e.g. credentials, color settings, resolution).
• All configuration, including hashed passwords, is stored in one file - easy to move between computers.
• Lightweight, free, reliable.

Disadvantages:

• Some people don't like the navigation menu on the left when not in full screen mode. Personally, I got used to it quickly.
• It seems not to handle non-standard DPI settings well. For example, when I use the 125% zoom in Windows display settings and I find in RDP connections is a bit blurry. For that reason, on some machines I use Microsoft Remote Desktop instead. It handles this situation better.

Screenshot from the article:
How Sysadmins RDP efficiently using Remote Desktop Connection Manager

Answer 3

The most detailed answer is already there, made by asker. I only want to note that this problem may also happen when client computer OS is a home SKU, thus no local GP editor may be available, neither a domain policy is in effect. Nevertheless, the client may act as if the policy to always ask password is set (don't know what causes such a default - maybe some program installed?).

Then, it is useful to set the policy registry setting manually (MS RDP client checks it; you may find it using a tool like procmon). It is here:

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services]

"PromptForCredsOnClient"=dword:00000000

"DisablePasswordSaving"=dword:00000000

Answer 4

Reading through your questions, I stumbled over this Group Policy setting: Prompt for credentials on the client computer which you disabled.

MS Technet gives the following explanation on this setting:

Prompt for credentials on the client computer

This policy setting determines whether a user will be prompted on the client computer to provide credentials for a remote connection to a terminal server.

If you enable this policy setting, a user will be prompted on the client computer—instead of on the terminal server—to provide credentials for a remote connection to a terminal server. If saved credentials for the user are available on the client computer, the user will not be prompted to provide credentials.

Note If you enable this policy setting and a user is prompted on both the client computer and on the terminal server to provide credentials, run the Terminal Services Configuration tool on the terminal server, and in the Properties dialog box for the connection, clear the Always prompt for password check box on the Log on Settings tab.

If you disable or do not configure this policy setting, the version of the operating system on the terminal server will determine when a user is prompted to provide credentials for a remote connection to a terminal server. For Windows 2000 and Windows Server 2003, a user will be prompted on the terminal server to provide credentials for a remote connection. For Windows Server 2008, a user will be prompted on the client computer to provide credentials for a remote connection.

That sound exactly to be the scenario you are facing. You want to save the credentials on the client machine, so just enable the Prompt for credentials on the client computer setting.

Answer 5

In my case, the issue was that the *.rdp file downloaded from Microsoft Azure had the following line:

prompt for credentials:i:1

Normally checking 'save credentials' would change that line, but for some reason it also comes marked as 'read-only'.

---

Unmarking it as 'read-only' and changing the line to

prompt for credentials:i:0

in notepad fixed the issue.

Answer 6

I've tried all possible options and nothing help. I have resolved the issue by resetting the password that is stored in Windows Vault for RDP connection.

Steps to do:

1. Right click on RDP connection icon => Edit
2. Select "Always ask for credentials"
3. Connect. Input the right password and select "Remember my credentials"

That's all.

PS: The problem was caused by some Windows update.

Answer 7

I suggest using using Royal TS that does credential management much better than the mess that Microsoft's RDP does of it.

The latest version is commercial, starting at $35 for the individual license.

Or you can opt for Version 1.5.1, which is the last freeware version, that looks quite sufficient to do the job.

Answer 8

Don't know why, but this worked:

(Using Windows 7 Home Basic)  I did not preconfigure my username in the Remote Desktop Connection options window. Instead, I connected to the remote host and waited for the credentials (Windows Security) prompt. And then I gave the credentials (username and password) and checked the option to remember my credentials.

There is no group policy editor for Windows 7 Home Basic. Also, RDCMan (as suggested in another answer) did not help.

Answer 9

What worked for me was what is suggested in the Stack Overflow question you referred to. (https://stackoverflow.com/q/11847805/4330815) Not sure why it didn't work for you without that additional changes you mentioned, but according to what you wrote I guess you modified only 1 setting out of the 4 (the "Allow delegating saved credentials with NTLM-only server authentication" one) Either way thanks a lot for the details you provided.