Windows 10, Azure AD joined (Office 365) remote desktop connection (RDP)

[AlexB]

Morning

 

So I'm playing with Windows 10 Education (same issue on Enterprise).

 

I have joined the machine to my Office 365 Azure AD and can login with my Office 365 credentials. However, what I haven't been able to figure out is remotely connecting to the machine using my Office 365 credentials/account.

 

It appears that the computer locally refers to the account as AzureAD\.

 

For login I have tried:-

 

local\

AzureAD\

\

 

local\

AzureAD\

\

 

and nothing has worked. I've run out of combinations I can think of, has anyone else succeeded in using RDP to connect to a Windows 10 Azure AD joined machine with Azure AD/Office 365 account?

[AlexB]

Forgot to say, my Google-Fu has also failed me here

[Trashcat]

You have went into the system properties and ticked the box that says "Allow Remote connections to this computer", right?

 

 

• Right click the Start button, click "system"
  
• Click "remote settings" link on the left side of the window
  
• Tick "Allow remote connections to this computer"
  

 

By default it is set to disallow on first install. Don't forget to add your users too.

[AlexB]

Aye, I can remote in with either a Microsoft Account (live) or a local account

[diver2061]

I've got the same problem. RDP is enabled. RDP works for the local PC admin account, but fails on the AzureAD account. The error I get is "Your credentials did not work." Like you I have a feeling it is just a matter of finding the right domain\username combination but I have not found it yet.

 

I wonder if the issue is related to some username transposition. While installing Win10 I used my name as the local admin account, however my name is also the username for the local domain. The AzureAD created a different username for me and now they may not be linked. I'm just guessing though.

[AlexB]

As a further experiment I connected another Windows 10 machine to my Office 365 Azure AD, logged in with Office 365 credentials and tried to connect to see what credentials it passed automatically

 

It passed AzureAD\, but neither the Office 365 password, nor local PIN worked.

 

I have a worrying feeling it can't work atm

[AlexB]

p.s. Welcome to EduGeek

[diver2061]

Here is another forum on the topic. I don't see an answer there either.

 

https://social.technet.microsoft.com/Forums/windowsserver/en-US/5d67f718-51f7-469d-836e-c3829c1ac099/remote-desktop-connection-using-azuread-credential?forum=winRDc

[diver2061]

Thanks AlexB

[diver2061]

According to this blog from 7/29, it is not yet support. But the blog gives the impression that RDP with AzureAD credentials may be supported soon.

 

https://social.technet.microsoft.com/Forums/en-US/05e1edd8-e22b-4865-8cb8-87673347f450/azure-ad-join-vs-rdp?forum=win10itprogeneral

[AlexB]

According to this blog from 7/29, it is not yet support. But the blog gives the impression that RDP with AzureAD credentials may be supported soon.

 

https://social.technet.microsoft.com/Forums/en-US/05e1edd8-e22b-4865-8cb8-87673347f450/azure-ad-join-vs-rdp?forum=win10itprogeneral

 

Cheers, I guess that confirms my gut feeling after playing with it for a while. Thanks for the info, your Google-Fu is clearly stronger than mine!

[diver2061]

Thanks. I also found a reference to someone who remotes in with the admin credentials and then waits for the screen-saver/windows lock screen. Then they can login using the AzureAD credentials. I haven't tried yet, #anintnobodygottimeforthat. But it is worth at try.

[AlexB]

Interesting, I'll give that a shot tomorrow

[AlexB]

No joy for me. You can speed up lock with "rundll32.exe user32.dll,LockWorkStation", but I could only find the option to type the password for the account I'd connected with.

[SpaghettiCook]

After playing around with a plethora of settings I managed to log on to my virtual windows 10 system via rdp with an office365 account. For me the final breakthrough was the discovery that locally the account is formatted as AzureAD\FirstnameSurname.

 

I had been logged on via a hyperV console and changing accounts with different settings when I noticed the start menu showed "user AzureAD\SpaghettiCook signed in". When I tried this for the rdp it finally worked!

 

Should I still be the only one here who managed this please let me know and I will try and find out what other settings were essential.

[AlexB]

After playing around with a plethora of settings I managed to log on to my virtual windows 10 system via rdp with an office365 account. For me the final breakthrough was the discovery that locally the account is formatted as AzureAD\FirstnameSurname.

 

I had been logged on via a hyperV console and changing accounts with different settings when I noticed the start menu showed "user AzureAD\SpaghettiCook signed in". When I tried this for the rdp it finally worked!

 

Should I still be the only one here who managed this please let me know and I will try and find out what other settings were essential.

 

Interesting, I wonder if an update changed that, as I did try the local signin name. Sounds like a good time to try again.

[AlexB]

So I was able to login to the hyper-v window as AzureAD\. However, when I try to rdp (From a Windows 10 Ent client) to that machine and enter AzureAD\ for the username, it fails and return me to the RDP login prompt, but the username has been replaced with AzureAD\.

 

I'm trying windows updates on the remote machine ATM (it's been turned off as rather useless!) and I'll see what happens.

[SpaghettiCook]

I have removed the machine from the AzureAD because although I sort of succeeded it was not really workable and thus I decided I would try again maybe in a few months.

 

So I don't have a working example anymore. Nevertheless I can tell you that what worked for me. In the RDP dialog I filled in the username in the email format, as in [email protected] and the corresponding password. Then I would get to the login screen of the VM with an RDP error 13031 "you can't sign in with a user ID in this format". From this screen I would fill in the username as AzureAD\FirstNameSurname and the same password and then I would be logged in. Weird, but it worked :-)

 

Another peculiarity was that if I would login this way the mouse would not always work correctly, eg clicking the start button would register as a click on the Edge button pinned to the taskbar. This did not happen in a console session with the same VM or afterwards now that I have taken it out of the AzureAD.

[AlexB]

No joy after updating

[AlexB]

Ah well, like you say, maybe in a few months

[EduTech]

I assume you guys are getting the following error: "The credentials that were used to connect to $env:computername did not work. Please enter new credentials." if so this is a known issue and is by design as it stands, this is because RDP requires network authentication protocol that won’t work on Azure AD joined clients.

 

Feedback has been received from the community in regards to this particular aspect, I can't give you any further details but it is on our radar internally. I hope that at least helps close this out.

 

I also want you to understand that in respect to Azure AD Joined Clients you will notice although there is a SID for this account and you can do stuff via Command Prompt in terms of net localgroup etc. there is not an actual 'Local User Object' for the account. The UI does not allow you to query your Azure AD directory like you would do with a traditional domain joined machine. I also am aware of other feedback in terms of NTFS permissions, the same applies the idea is that use add-on cloud services such as One Drive etc. in terms of File Storage / Sharing etc.

 

We will be issuing guidance as this is a common scenario, I know that is not relevant for your RDP aspect and we have various 'genuine' scenarios where by it is being asked for i.e. many organizations use RDP to support end-users amongst others etc.

 

Thanks,

James.

Edited October 9, 2015 by EduTech

[AlexB]

Thanks for the clarification... saves all the guessing

 

HAPPY FRIDAY!

[cvirguez]

HI All Spaghetticook is correct. in my case the trick was the following. when establishing the RDP connection, type as user .\administrator (yes the local admin like diver2061).. do not type a password... this way you get on your remote to the initial screen where it will ask you for your password...... in that screen you change the user to be azuread\firstnameSecondnameLastname (your name with no spaces in between).. and you password.. and Voila!!!! you are in.....

[AlexB]

HI All Spaghetticook is correct. in my case the trick was the following. when establishing the RDP connection, type as user .\administrator (yes the local admin like diver2061).. do not type a password... this way you get on your remote to the initial screen where it will ask you for your password...... in that screen you change the user to be azuread\firstnameSecondnameLastname (your name with no spaces in between).. and you password.. and Voila!!!! you are in.....

 

What is your client OS? When I try this I just get "Login attempt failed". I am attempting from a Win 10 Ent machine to a Win 10 Edu machine connected to an Office 365 AzureAD

[AlexB]

I came back to this and found https://morgansimonsenblog.azurewebsites.net/2015/11/06/connecting-to-an-azure-ad-joined-machine-with-remote-desktop/

Whether there is a better method now, I'm not sure, but this works for me.