Protected Users group causing issues with RDP

Question

Dear all, 3rd part Security company provides a report on vulnerabilities in the environment and any steps to mitigate or reduce. One of these items related to placing privileged accounts in the protected security group but as a consequence none of them were able to RDP servers any longer. On removing them it worked again and we knew this was the issue due to the error and our good friend Google.

We do have NLA configured as well if this is a factor. Is there a workaround which does not mean removing the account(s) from the Protected Security Group?

Answer 1

Hi @Testing

When you add a admin account to protected users group , NTLM will be disable.

When a admin try to access through RDP for Example using the IP adresse , the authentication will be failed because it using ntlm authentication. You have to ask admin to use the FQDN of server serverName.domain.lan to use kerberos instead of ntlm When kerberos authentication failed , the problem should be:

• Missing SPN
• Network flow problem

If it's not possible to use kerberos authentication , you should remove admin account from protected users to let him access through RDP on target server.

---

Please don't forget to accept helpful answer

Answer 2

Hello, You have to contact your system admin to modify your authentication method. This is the official link about protected users securiity group : Protected Users Security Group | Microsoft Learn

---If the Answer is helpful, please click "Accept Answer" and upvote it.

Answer 3

Hi,

i think that you had the same problem as me

try enableing GPO: Key Distribution Center (KDC) client support for claims, compound authentication and Kerberos armoring

path: Computer Configuration | Administrative Templates | System | KDC.

Link to MS article:https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/how-to-configure-protected-accounts

Please do have in mind that when you are using kerberos you cant user IP addresses for RDP, only fqdn's (server.domain.local).

Answer 4

Try login with UserID@DomainName instead of DomainName\UserID