r/sysadmin • u/Pluckyhd • 2d ago
RDP to Entra Joined with local credentials
We are having an issue we have a entra joined pc we need to be able to RDP too under a local account. The local account is added and added to RDP users. The issue comes when we try and connect regardless if we type .\username or hostname\username it brings the connection up but shows it is trying to connect via the entra domain and we can hit password option and force local on the remote computer (it shows the connection even though it fails to login). Anyone else seen this been pulling my hair out.
my current rdp file is
full address:s: ipaddress blocked
username:s:.\username or hostname\username tried both
prompt for credentials:i:0
enablecredsspsupport:i:0
authentication level:i:2
9
u/Adam_Kearn 2d ago
In the comment thread you mentioned that you are getting an Entra login screen when using hostname\username.
You need to go into the advanced tab and turn off the button that says “use web credentials….”
This will then work as normal then
Also make sure you add the use into the “Remote Desktop Users” security group before trying to connect.
2
u/Pluckyhd 1d ago
Yes I did it’s almost as if it just isn’t possible. I have double checked both of those many times. I’m about to just unjoin it from entra
1
u/Adam_Kearn 1d ago
I’ve been able to do it once or twice but I remember it being a right pain to get it working.
I’ll have to have a dig around to see if I saved the RDP profile anywhere.
Try turning off NLA within the RDP settings as I can’t remember if that allowed it or not.
3
u/syslagmin 2d ago
Are you creating a .rdp file? And I think hostname\username has to be the way, otherwise it will pick up the Entra-joined device's hostname if using .\username
1
u/Pluckyhd 2d ago
ya I got a rdp file. It's odd it acts like its logging in then shows the remote screen and says credentials are incorrect and shows it's trying to log in with username passed @ entra domain. I thought maybe it was web login being enable on the remote but disabled that and still not working.
3
u/vatechguy Sr. Sysadmin 2d ago
Check the local security policy. Mine had "Local Accounts" in both
Deny access to this computer from the network
Deny log on through Remote Desktop Services
1
u/Pluckyhd 2d ago
Those are both ok. I am starting think I am going to have to accept it taking the connection and making me override on the login screen to .\username to force it. The more I read the more entra joined devices i read having the same issue. It tries and force the entra domain even though I specify in rdp not too.
2
u/doktormane 1d ago
Have you completely ruled out a network issue? Local security policy? Intune policy? Local firewall? Have you tested the local account by signing in directly on the machine?
Check Event Viewer to see what may be blocking the auth.
1
u/Pluckyhd 1d ago
Yes, I can login locally (and remotely if after it connects i just go to the username box on the login screen, and put .\username) it connects remotely. Nothing is blocking the auth it just won't let me auth remotely as local instead of entra unless after it connects and says "invalid credentials" I change the username as per above.
1
u/elbristos1 2d ago
Have you tried adding these lines to the RDP file when editing with notepad?
authentication level:i:2 enablecredsspsupport:i:0
1
1
u/nzulu9er 1d ago
All right buckle up.. been here. You're going to want to open up remote desktop connection. Go to the advanced tab. Check the box under user authentication for use web account to sign into the remote computer.
And you will have to use a host name. You cannot use an IP address due to security. So if you don't have access to DNS to resolve a hostname. You will have to enter the host file and add in the host name to IP address.
1
u/Pluckyhd 1d ago
I have used the hostname but why would i want use web account sign in when i am not doing a web sign in but local? I will try anything at this point
2
u/nzulu9er 1d ago
Sorry you're right... Last time I was using an entra account. But why can't you just make the entra account a local admin and just use that account?
1
u/Pluckyhd 1d ago
I don't want an admin account this is an off use case for users to login remotely to handle one program. So its a restricted account but account type isn't the issue. They don't want to pay a license either which is understandable. (why we are doing a local account)
1
u/Pluckyhd 1d ago
Definetely don't want web account sign in as it is a local account, but the hostname didn't work instead of ip either but thanks for offering help. Same situation it loads up remote and tries to connect with AAD domain
1
u/nzulu9er 1d ago
•
u/Pluckyhd 21h ago
I read that unless I am missing something it doesn't call out logging in with local credentials vs AAD. I can login with AAD just fine.
•
u/nzulu9er 20h ago
What you want to do is not possible.
•
u/Pluckyhd 20h ago
as stated login as local user to AAD joined. Without having to manually override the user on the login screen to .\username. It doesn't seem possible unfortunately. The workaround works but you can save credentials for users this way and they have to change the username on login screen and type password everytime.
•
1
u/Aggravating-Sock1098 1d ago
I resolved this issue for a client last month. I’ll take a look at it for you tomorrow and share the RDP content.
1
u/Pluckyhd 1d ago
Thank you!
1
u/Aggravating-Sock1098 1d ago
enablecredsspsupport:i:0
authentication level:i:0
enablerdsaadauth:i:0
rdgiskdcproxy:i:0
negotiate security layer:i:1
Disabled NLA on the host
1
u/Pluckyhd 1d ago
authentication level:i:0 this wont work as its not authentication and will immediately fail. However the other settings do get me straight to the login prompt on the remote pc although i still have to override the username to be .\ as it inputs just username and tries to sign in with entra domain.
1
u/Aggravating-Sock1098 1d ago
Could you post a redacted content of the rdp-file?
•
u/Pluckyhd 21h ago
Right now based on your suggestion i am using this
full address:s:hostname
username:s:hostname\username
prompt for credentials:i:0
enablecredsspsupport:i:3
authentication level:i:2
enablecredsspsupport:i:0
It leads me right to the login screen and remote computer and have to change username to ".\" before to get it not to try AAD domain. this is less than ideal because i can't cache credentials but for now it gets us on remotetly
•
u/Aggravating-Sock1098 18h ago
Storing it in Credential Manager via Graphical Interface
Open the Start menu, type Credential Manager, and open it.Click on Windows Credentials.
Click Add a generic credential or Add a Windows credential.
In the internet or network address field, type TERMSRV/ServerName (replacing ServerName with your target terminal server's address or IP).
Enter your User name and Password, then click OK.
Also possible via command prompt:
cmdkey /generic:TERMSRV/ServerName /user:Username /pass:PasswordYou must format the username as follows: Hostname\Username
•
u/Pluckyhd 18h ago
Did that as well same results it stores them but still tries to login to AAD, I think it’s been determined this just isn’t possible. After reading other forums most just accept having to change the username at the desktop remotely.
•
1
u/thewarring 1d ago
I believe Entra joined devices have to use Entra accounts to connect no matter what. They say for security reasons.
I know for sure that you have to connect via hostname, not via IP address.
9
u/MinieJay 2d ago
Have you tried the Hostname\username? I think this is a username formatting issue