0

I created an AD DS and domain called NEWDOM. Then I added a Win2012 machine "newPC" with a local account called "userA" and joined it to the NEWDOM domain.

If I use my personal PC on home network, I can RDP to the machine without issue by providing "userA" or "newPC\userA" as username.

But if I use my company provided laptop, joined to COMPANYDOM but still connected to my home network, it refuses the credentials. Audit logs on newPC show that it's attempting to use COMPANYDOM instead of newPC. The XML says "TargetDomainName" is COMPANYDOM. I've tried userA, newPC\userA, and userA@newPC and all give the same credentials error.

If I don't join newPC to the NEWDOM domain, it connects to RDP, even if on my company's network. If I drop the machine from the NEWDOM domain, the issue persists. Leads me to believe it's a GPO setting on the NEWDOM DC that's causing that but I'm not positive.

Is there a policy setting on my company laptop that is causing this or a setting on the NEWDOM domain controller?

Edit: If I use a NEWDOM domain admin account, RDP works. Only local accounts seem to have problems. For reasons that I don't need to get into, I need the ability to RDP as local user accounts.

Thank you!

0

Issue appears to be that the work PC has the following key: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\LSA\LmCompatibilityLevel=1 which restricts NTLM to version 1, which Windows Server 2012 does not support.

  • Yes, it is in the groups Users, Administrators, and Remote Desktop Users. It is not the default Administrator account but rather an account I created locally on the machine prior to joining the domain. If I try to RDP from a machine not on COMPANYDOM, it works fine. It's only when I try to connect from my COMPANYDOM-joined laptop. – negativefx Apr 8 '16 at 14:46
  • Sorry yes, you did explain it correctly. Maybe the firewall is set to only allow RDP connections within your company subnet? – smwk Apr 8 '16 at 15:02
  • I have a Domain Admin account set up on NEWDOM. If I use the COMPANYDOM machine to RDP in, and I provide that NEWDOM domain admin account rather than local admin account, it connects without issue. – negativefx Apr 8 '16 at 15:24
  • What if you logon as .\usera ? What version of RDP are you using? – smwk Apr 8 '16 at 15:43
  • On the Win 7 COMPANYDOM machine, it's 6.2.9200 and supports RDP 8.0 and NLA. On my personal win10 desktop, it's 10.0.10586 and supports RDP 10.0 and NLA. – negativefx Apr 8 '16 at 15:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.