Client Auto Login with Remote Desktop Services?

[jmair]

Thanks in advace for any suggestions on a recommended way to solve this problem.

 

I have a Remote Desktop Services server running. It is configured and works great when logging in with remote desktop connection. I now want to setup a student machine in one of the thick-client labs. I would like to configure the XP machine to be 100% passive, so the student has no idea they are using RDC. What would you recommend I use to solve this?

 

 

Thanks again.

[FN-GM]

I have recently done this, there is a group policy for it. I will send you the stuff when i get home. I cant remember where it is on top of my head. If i dont get back to you please PM me.

[TheScarfedOne]

Likewise...done it here with Windows Thin PC. Will also go hunting for the setting - and that reminds me to go and update/add blog posts on the changes made to this from my original setup.

 

See my blog for some background..

[FN-GM]

Likewise...done it here with Windows Thin PC. Will also go hunting for the setting - and that reminds me to go and update/add blog posts on the changes made to this from my original setup.

 

See my blog for some background..

 

Sounds like you have a setup like the one i am trying to get sorted. The user logs into Thin PC and they are then connected through to an RDS session. I am currently stumped on the security prompt coming from MSTSC.

[PeterH]

What you want to do is possible but a bit fiddly to set up.

 

Some prerequisites:

 

 

• Windows XP SP3
  
• Remote Desktop Client 6.1
  

 

To start with, you need to enable CredSSP support. This is done in the registry as follows. Note that this only works on XP SP3! Make the following registry changes:

 

HKLM\SYSTEM\CurrentControlSet\Control\Lsa

 

Security Packages – APPEND tspkg

 

HKLM\System\CurrentControlSet\Control\SecurityProviders

 

Security Providers – APPEND , credssp.dll (the comma is important)

 

To veryify that this is working, open the remote desktop client mstsc.exe. Right-click in the title bar and choose About. It should say Network Level Authentication supported and Remote Desktop Protocol 6.1 supported.

 

The next step is to enable delegation of credentials. This allows you to specify the RDS servers to which the client will delegate credentials. This can be done through group policy or alternatively, it can be done in the registry. You can find out more about credentials delegation here - Description of the Credential Security Support Provider (CredSSP) in Windows XP Service Pack 3

 

The group policy setting will work on XP SP3 clients but to edit it you will need to use the group policy management console on either Vista/7/2008

 

Method 1 – Group Policy

 

Computer Configuration | Administrative Templates | System | Credentials Delegation

 

Allow Delegating Default Credentials – Enabled

 

Add your RDS servers to the list like this:

 

TERMSRV/my-rds-server-01

TERMSRV/my-rds-server-02

TERMSRV/my-rds-server-03

etc...

 

If you have more than one RDS server, you will need to add them all into the list above. Alternatively, you can use wildcards, so you can do something like *.mydomain.internal or to allow delegation to ANY RDS server in any domain, just use TERMSRV/*

 

Concatenate OS defaults with list above – ticked

 

If your RDS servers require NTLM authentication, you will need to enable Allow delegating default credentials with NTLM-only server authentication and configure it as above

 

Method 2 – Registry

 

The group policy settings above correspond to the following registry entries:

 

Path: HKLM\SOFTWARE\Policies\Microsoft\Windows\CredentialsDelegation

Name: ConcatenateDefaults_AllowDefault

Type: REG_DWORD

Data: 1

 

Name: AllowDefaultCredentials

Type: REG_DWORD

Data: 1

 

Path: HKLM\SOFTWARE\Policies\Microsoft\Windows\CredentialsDelegation\AllowDefaultCredentials

Name: 1

Type: REG_SZ

Data: TERMSRV/my-rds-server-01

 

This contains the list of your rds servers. If you have more than one you need to add them all or just use TERMSRV/*

 

If your RDS servers require NTLM authentication, you will need to make the following registry settings as well:

 

Path: HKLM\SOFTWARE\Policies\Microsoft\Windows\CredentialsDelegation\AllowDefCredentialsWhenNTLMOnly

Name: 1

Type: REG_SZ

Data: TERMSRV/my-rds-srver-01

 

Again, this contains the list of your rds servers. If you have more than one you need to add them all or just use TERMSRV/*

 

There’s some more information here which might be helpful

[FN-GM]

This will do it. Nice quick and easy. No need to edit any registry settings.

 

How to enable Single Sign-On for my Terminal Server connections - Remote Desktop Services (Terminal Services) Team Blog - Site Home - MSDN Blogs

[teky]

Sounds like you have a setup like the one i am trying to get sorted. The user logs into Thin PC and they are then connected through to an RDS session. I am currently stumped on the security prompt coming from MSTSC.

Is the security prompt saying that it does not know the RDS server? If it is then you will need to digitally sign the RDP file with the cert from the RDS server, then there is another GPO setting where you put the hash of the cert into the Thin PC's trust connection list so that it connects automatically without the "Are you sure?" prompt

[FN-GM]

Is the security prompt saying that it does not know the RDS server? If it is then you will need to digitally sign the RDP file with the cert from the RDS server, then there is another GPO setting where you put the hash of the cert into the Thin PC's trust connection list so that it connects automatically without the "Are you sure?" prompt

 

Dont have any guides for this do you please?

[teky]

Dont have any guides for this do you please?

 

It's best if you have an internal certificate authority server setup else you will need to add the certificate to each thin client's certificate store.

 

Here is how to sign the RDP file, you will find the hash thumbprint needed in the certificates properties: Rdpsign

And here is the group policy location for forcing the clients to trust the connection: How do I remove the security warning on Remote App

 

TheScarfedOne should have this along with other info in his blog when he updates it

Edited December 1, 2011 by teky

[jmair]

This will do it. Nice quick and easy. No need to edit any registry settings.

 

How to enable Single Sign-On for my Terminal Server connections - Remote Desktop Services (Terminal Services) Team Blog - Site Home - MSDN Blogs

Thanks a ton. I'll give this a shot!

Thanks again!