up vote 3 down vote favorite
1
share [g+] share [fb]

When I remote desktop to my Windows Server 2008 (a hosted virtual server) I see a login screen showing an icon for each user in the system. I can click on a user then enter a password and login.

This is a terrible security oversight in my opinion as it gives anyone that might want to compromise my server a full list of valid usernames. Is there a way to revert to the old style of login screen requiring both username and password?

Thanks

link|improve this question
100% accept rate
feedback

3 Answers

up vote 1 down vote accepted

Seconding/mirroring FoxInSocks' answer, you can change this in the Local Security Policy (secpol.msc).

From the left-hand "Security Settings > Local Policies > Security Options" tree option, change the setting named "Interactive logon: Do not display last username" to Enabled.

If you want to apply this to all servers in your domain, login to your DC and open the Group Policy Editor, either by opening Active Directory Users and Computers, right-clicking the domain node, choosing Properties, then the Group Policy tab and clicking the Edit button; or opening Group Policy Management, right-clicking the Default Domain Security Policy entry and choosing Edit.

With the Group Policy Editor open, navigate to the left-hand "Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options" tree option and change the setting named "Interactive logon: Do not display last username" to Enabled.

HTH

J.

link|improve this answer
feedback
up vote 1 down vote

What RDP client are you using to connect to the server? Do you really see a full list of all the users on the server, or just a list that includes your username, and the username specified in your RDP connection settings?

If you require Network Level Authentication on the server, basically dropping support for all RDP clients less then 6.1 and all non-Microsoft clients, then you will be prompted for a password by the RDP client before the RDP session is even established.

link|improve this answer
Interestingly it's only the Windows XP mstsc.exe client that does this. Vista prompts for a username and password before showing the screen. With XP I see all the users on the server, whether they are able to RDP or not (things like IIS accounts etc also appear in the list) I'll look into dropping NLA support thanks for the suggestion – user38553 Mar 25 '10 at 17:06
Do you have sp3 and the latest Remote desktop client installed on windows XP (7.0)? – Zoredache Mar 25 '10 at 17:20
feedback
up vote 0 down vote

Start > Run > "gpedit.msc".

Navigate to "Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options"

There are a plethora of ways to tighten up your system.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.