• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1807
  • Last Modified:

Login screen to Windows 2008 R2 Terminal server

Hi there

We just replaced our Windows 2003 terminal server with Windows 2008 R2 terminal server.

On old terminal server, we used to get to the server and get the login screen of username, password and domain.

On the new terminal server, even before we actually see the Windows 2008 R2 server, the RDP client asks us for the username and password.

Ideally, when a user puts the server name in the RDP client and clicks on connect, we want two things.

1. Instead of asking for username password right then, it should take us to the server and it should present us with the username and passwords field.

2. The logon domain, by default, is set to the servers's computer name. It should be set to the domain name.

Setup we have is simple. One domain controller and one terminal server.

Users logon to the TS from domain computers as well as from remote locations where the computers are not part of the domain.

What I don't know is if this is RDP client issue or server side issue and I don't know what setting to change.
0
alex110109
Asked:
alex110109
  • 4
  • 3
  • 2
1 Solution
 
Mike SchultzLevel 2 Desktop SupportCommented:
Try editting the default.rdp client
It is located in the root of the My Documents folder

Open/edit default.rdp with notepad
Insert the following line

enablecredsspsupport:i:0

Save and exit
0
 
McKnifeCommented:
Hi.

You now have a modern TS, you should not even worry about this :) Turn on single sign on, no more password typing.
0
 
alex110109Author Commented:
Hi Mike

Thanks for the tip.

We have prevented use of saved creds because of security.

Does your setting conflict with that?

I am aware of saving the creds but due our security policy, we get a message on the rdp client itself that the server doesn't allow saved creds and again prompts you for the details.

What I want is that the RDP client shouldn't ask me for login info at all and take me to the server and that's where I type my login information.

I don't know if this is possible, but if it is, I would like to know.
0
Improve Your Query Performance Tuning

In this FREE six-day email course, you'll learn from Janis Griffin, Database Performance Evangelist. She'll teach 12 steps that you can use to optimize your queries as much as possible and see measurable results in your work. Get started today!

 
Mike SchultzLevel 2 Desktop SupportCommented:
enablecredsspsupport:i:0

The way I understood it is:

This does not save credentials but passses on the credentials that are currently logged into the PC.
0
 
McKnifeCommented:
0
 
alex110109Author Commented:
The SSO won't work because there are users who access the terminal server from computers which are not part of the domain.

Also we have users who login to TS using some generic logins.
0
 
McKnifeCommented:
Oh, feedback!
Well, I see.
1) That behavior is normal with 2008 RDP. It is a security mechanism that won't let you connect to the server until you authenticated. Not sure if this can be altered.
2) I don't experience it like that - do you start the rdp client with a domain account? Then this should not happen, I suppose.
0
 
alex110109Author Commented:
Hi McKnife

Ah, you say that but we do have our domain controller which is Windows 2008 R2 as well.

It does exactly what I need to do which is when you RDP into it, it doesn't ask you for username or password on the RDP client itself, but when you get connected, you see just the username and password field.

Anyway,  I will close the question as I am not getting anywhere with this, I am not sure why it works on the DC and not on TS.
0
 
McKnifeCommented:
I wrote: "not sure if that can be altered" - now you prove it can be altered as it works on one.
I strongly believe, it's this server-side policy:
"configure server authentication for client" [gpedit.msc - computer config - admin. templates - windows components - remote desktop services - remote desktop connection client]
This policy setting allows you to specify whether the client will establish a connection to the RD Session Host server when the client cannot authenticate the RD Session Host server.

If you enable this policy setting, you must specify one of the following settings:

Always connect, even if authentication fails: The client connects to the RD Session Host server even if the client cannot authenticate the RD Session Host server.

Warn me if authentication fails: The client attempts to authenticate the RD Session Host server. If the RD Session Host server can be authenticated, the client establishes a connection to the RD Session Host server. If the RD Session Host server cannot be authenticated, the user is prompted to choose whether to connect to the RD Session Host server without authenticating the RD Session Host server.

Do not connect if authentication fails: The client establishes a connection to the RD Session Host server only if the RD Session Host server can be authenticated.

If you disable or do not configure this policy setting, the authentication setting that is specified in Remote Desktop Connection or in the .rdp file determines whether the client establishes a connection to the RD Session Host server when the client cannot authenticate the RD Session Host server.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Problems using Powershell and Active Directory?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

  • 4
  • 3
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now