5,099 questions
Connect to AzureAD joined computer over RDP
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(179.20000000000002, 86%, 27%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EMP%3C/text%3E%3C/svg%3E)
Mountain Pond
1,576
Reputation points
Hello, maybe someone already solved the connection problem or maybe there is a way to solve this problem. You need to add two keys to the RDP file and only then can you connect successfully.
enablerdsaadauth:i:0
enablecredsspsupport:i:0
only after that, the user immediately gets to the device and enters the accounted data directly on the device. In this case, there are no problems.
Otherwise (by default), I will be prompted to enter a login and password before connecting and the user will get an error.
This is a serious problem, because you need to make changes on the client side. You need to send some kind of file that will be launched in order to connect, and this is extremely inconvenient.
Perhaps how can this problem be solved?
Thank you.
Windows for business | Windows Client for IT Pros | User experience | Remote desktop services and terminal services
Microsoft Security | Microsoft Entra | Microsoft Entra ID
25,130 questions
Microsoft Security | Intune | Other
5,570 questions
{count} vote
-
Pavel yannara Mirochnitchenko 13,336 Reputation points MVP2023-04-26T08:45:13.3366667+00:00 If you are using Intune, you can create Configuration Profile / Setting catalog to allow RDP and behave like you want it.
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(67.2, 68%, 16%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ELT%3C/text%3E%3C/svg%3E)
Limitless Technology 44,766 Reputation points2023-04-26T11:40:23.7133333+00:00 Hello there, When an Azure AD group is added to the Remote Desktop Users group on a Windows device, it isn't honored when the user that belongs to the Azure AD group logs in through RDP, resulting in failure to establish the remote connection. In this scenario, Network Level Authentication should be disabled to allow the connection. You can follow the steps from here to configure this https://learn.microsoft.com/en-us/windows/client-management/client-tools/connect-to-remote-aadj-pc Hope this resolves your Query !! --If the reply is helpful, please Upvote and Accept it as an answer--
-
Mountain Pond 1,576 Reputation points
2023-04-26T21:53:43.53+00:00 Hi, thank you.
But Require devices to use Network Level Authentication to connect is disabled by script.
This not helps to resove the issue.
-
Mountain Pond 1,576 Reputation points
2023-04-26T21:54:35.8+00:00 Hi, thank you.
But what I need to specify, this options are on client side.
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(214.4, 81%, 30%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EMT%3C/text%3E%3C/svg%3E)
Marilee Turscak-MSFT 37,206 Reputation points Microsoft Employee Moderator2023-04-26T23:24:13.18+00:00 Have you tested while disabling MFA and Conditional Access policies, adding targetisaadjoined:i:1 as a custom RDP property to the host pool, and checking the prerequisites in the article?
https://docs.microsoft.com/en-us/azure/virtual-desktop/deploy-azure-ad-joined-vm
-
Mountain Pond 1,576 Reputation points
2023-04-26T23:27:46.7+00:00 Hi, sorry but this is not AVD host. This is migrated from on-prem to AzureAD host. So I need do somthing on host side with Configuration Profiles or by Script. I realy don`t want to push this rdp file to each user :)
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(147.20000000000002, 32%, 24%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ED5%3C/text%3E%3C/svg%3E)
DM-5016 0 Reputation points2024-03-15T13:47:39.6766667+00:00 Connecting to an Azure AD joined computer by disabling all Terminal Service security is not the right way to go about this.
By default the Remote Desktop Client use NLM/NTLM. This is not supported when connecting to an Azure Join PC (or at least we didn't get it to work).
Assuming you have all the settings correct in Azure AD already, In order to RDP to a computer that is Azure AD joined you simply have to click this checkbox (which does the same as adding options to the RDP file) and it will even work with SSO/MFA.
It doesn't work with IP adress though, only FQDN. If you connect locally (at home or similar) you can add a pointer in local DNS/hostfile as a workaround.
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(294.40000000000003, 57.00000000000001%, 38%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EDS%3C/text%3E%3C/svg%3E)
Debbie Singer 0 Reputation points2024-08-20T15:41:00.42+00:00 I have spent weeks on this and this worked for me. Just adding those two lines. I had to monkey with the user name but I can now use RDP and I can log in from the network pane as well. Even RDP on my Mac works. Now to figure out how to mount the drive from the Mac. Thank you again.
Sign in to comment
Sign in to answer