I'm trying to define logonHours for Remote Desktop users on Windows Server 2012; Network Level Authentication is required for remote connections. When an account with restricted logonHours (defined in ActiveDirectory) tries to connect at a denied time, the client (Remote Desktop Connection) responds with:
An authentication error has occurred. The Local Security Authority cannot be contacted.
If the account tries to login at allowed times, everything works fine. If Network Level Authentication is not required, then the client connects to the server, which denies the logon, but displays the much nicer error message "Your account has time restrictions..."
Is there some way to still require NLA, but present the friendlier notice about time restrictions? Am I missing a policy setting or some other configuration?