Connect to AzureAD PC (Bare Metal) over VPN with Remotedesktop

Question

Hello,

a Customer dumped his Server an lokal AD. All PCs are connected to Azure AD now (No Intune Supscription) and the Users login with their O365 credentials on the PCs.
One User usually used a personal Notebook (not in Azure AD) that connects from his Home Office via VPN to the lokal Network of the Company. Usually he then connected via RDP to his PC in the Company.
After de AD-Swap to AzureAD The Connection doesnt work anymore.

What steps did i try?

• Activated RDP on the Target-PC
• Allowed RDP Connection for the Azure-AD User on the Target-PC (AzureAD\userprincipal)
• Set the Azure-AD User as Remote-Desktop-User an Lokal-Admin
• Set the Option "User Web Authentication" at the RDP-Client
• Disabled MFA Sitewide
• Disabled Windows Hello Sitewide
• Changed the IP-Adress at the RDP-Client to the FQDN of the PC
• Set a manual entry in the Hosts-File so that the FQDN gets resolved correctly

Whats the Problem?

• When i try to connect to the PC, a O365 Authentication Window appears, where i have to type in the Userprincipal and Password. After hitting Connect it takes some time and then gives me an Error "Internal Error" and doesnt connect.

Hint:

• Even tough i disabled the MFA and Windows Hello, the users still get prompted to set MFA or Windows Hello Authentication at Bootup. Maybe thats the Problem?

How can i solve that?

Answer 1

Hello,

Based on the information provided, it seems like the issue might be related to the user's authentication process and the presence of MFA and Windows Hello prompts even after disabling them. Here are some steps you can take to troubleshoot and resolve the problem:

Verify MFA and Windows Hello settings:

Make sure that MFA and Windows Hello are truly disabled for the user in question. Double-check the Azure AD user settings and confirm that the options are disabled correctly. It's possible that there might be a delay in the changes taking effect, so allow some time for the changes to propagate through the Azure AD.

Clear cached credentials:

On the personal notebook that the user is using to connect via RDP, clear any cached credentials or saved passwords related to the target PC. This can help ensure that the RDP client is not using outdated or conflicting authentication information.

Use Azure AD credentials explicitly:

When connecting via RDP, make sure to explicitly specify the Azure AD user's credentials in the RDP client's login screen. Instead of using the "Remember me" option, enter the username and password manually. This ensures that the correct credentials are used for the RDP connection.

Check VPN connectivity:

Ensure that the user's personal notebook can successfully connect to the company's network via VPN. Verify that the VPN connection is stable and not experiencing any issues that might affect the RDP connection.

Check firewall and network settings:

Ensure that the necessary ports for RDP (TCP port 3389) are open and allowed through any firewalls, both on the personal notebook and the target PC within the company's network. Also, check for any network connectivity issues that might hinder the RDP connection.

Test with a different Azure AD user:

Try connecting to the target PC using a different Azure AD user account from the personal notebook. This can help determine if the problem is specific to the user's account or a more general issue with RDP connectivity.

Verify Azure AD Conditional Access policies:

Check if there are any Azure AD Conditional Access policies in place that might be affecting the RDP connection. These policies can enforce specific requirements for authentication, so make sure they are not causing conflicts.

Review Azure AD Sign-in logs:

Check the Azure AD Sign-in logs for any errors or anomalies related to the user's RDP connection attempts. This can provide valuable information about the cause of the "Internal Error."

Test RDP from a different network:

Try connecting to the target PC via RDP from a different network (e.g., a different home network or a mobile hotspot). This can help determine if the issue is specific to the user's home network.

If the problem persists after trying these steps, consider reaching out to Microsoft Support for further assistance, as they can delve into more specific details about the Azure AD configuration and provide advanced troubleshooting support.

Remember always to exercise caution and ensure security measures when dealing with remote connections and user credentials.

I used AI provided by ChatGPT to formulate part of this response. I have verified that the information is accurate before sharing it with you.

Hope this resolves your Query !!

--If the reply is helpful, please Upvote and Accept it as an answer–

Answer 2

Hi @Fabian Sitta - web&IT Solutions , please check the following for me:

1. Ensure that the PKU2U protocol is enabled on both the local PC and the session host.
2. Make sure per-user multi-factor authentication is disabled for the user account, as it's not supported for Azure AD-joined VMs.
3. Check if there are any Conditional Access policies restricting access.

If this doesn't help please send me an email at "azcommunity@microsoft.com" with subject "ATTN: James Hamil" and your subscription ID I can open a free support ticket for you.

Please let me know if you have any questions and I can help you further.

If this answer helps you please mark "Accept Answer" so other users can reference it.

Thank you,

James