We have a Windows Server 2008 R2 system that can't be accessed remotely via RDC from windows systems (I've tried Windows 10, Windows 7, Windows 2012 R2 all without luck). Paradoxically, our SysAdmins who run MacBooks are able to connect using the MS RDP Client for Mac.

In examining a WireShark trace I see the following for sessions that fail:

  • Client - SYN
  • Server - SYN, ACK
  • Client - ACK
  • Client - RDP
  • Server - ACK
  • Server - RST, ACK

The 'RDP' Packet above has the following information:

  • TPKT Version 3
  • PDU Type: CR Connect Request
  • Type: RDP Negotiation Request
  • requestedProtocols: TLS security supported, CredSSP supported, Early User Authorization Result PDU Supported

For the Macs, I see a negotiation that looks like this:

  • Client - SYN, ECN, CWR
  • Server - SYN, ACK
  • Client - ACK
  • Client - RDP (Cookie:= .\username, Negotiate Request) [First Try]
  • Server - ACK
  • Server - RST, ACK
  • Client - SYN, ECN, CWR
  • Server - SYN, ACK
  • Client - ACK
  • Client - RDP (Cookie:= .\username, Negotiate Request) [Automatic retry]
  • (Normal RDP traffic, I can connect and it works)

The First try RDP packet looks like this:

  • TPKT Version 3
  • PDU Type: CR Connect Request
  • Type: RDP Negotiation Request
  • requestedProtocols: TLS security supported, CredSSP supported, Early User Authorization Result PDU Supported

The Automatic retry RDP packet drops the requestedProtocols:

  • TPKT Version 3
  • PDU Type: CR Connect Request
  • Type: RDP Negotiation Request
  • requestedProtocols: empty

At this point I'm trying to figure out how to get the windows RDP client to renegotiate like the Mac client. I've had no success yet. Has anyone had to contend with this before?

Additional context:

  • I have tried connecting from Windows 10 and Windows 7 with the same results
  • I am limited in that I can't change the RDP settings on the 2008 R2 server (extremely limited change control window).
  • Have you tried the UWP remote desktop client? Anyhow, my suspicion is it might be a problem related to certificates but I'm really just guessing here. – bviktor Jan 31 '17 at 0:15
  • @bviktor Yes, unfortunately I see the same behavior with both the UWP remote desktop client as well as the 'classic' RDP application. – bluemorpho Jan 31 '17 at 16:13

As tends to happen to me, I stumble across the answer pretty quickly after posting a question. In talking with the System Administrators for the Windows Server in question I discovered:

  • TLS 1.0 was disabled to comply with security compliance requirements
  • RDP was configured to allow connections from any version of the RDP client (NLA was disabled)

With this information I discovered a blog post about How To Disable Credentials Prompt of RDP 6.0 which revealed 'hidden' settings that could be configured to address the problem.

Solution:

  • Save an RDP session to a .rdp file
  • Edit the .rdp file in a text editor (Notepad++ worked for me)
  • Add the following lines to the end of the file:

    negotiate security layer:i:0
    authentication level:i:0
    enablecredsspsupport:i:0 
    prompt for credentials:i:0
    
  • Save the file

  • Double-click the .rdp file to open the connection.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.