Windows 11 24H2 refusing Kerberos for RDP

Question

I have noticed a strange behaviour in Windows 11 24H2.

When connecting to a Server using RDP with the following message:

My User is a member of the "Protected Users" Group in Active directory, so NTLM Authentication is not possible.

We usually can work around this by connecting to the FQDN of the Server and using the UPN of the User Account, which

then will use Kerberos for Authentication.

Since installing Windows 11 24H2 this does not happen anymore. Instead it will fallback to NTLM as seen on the Domain Controllers Security Eventlog:

An account failed to log on.

Subject:

Security ID:		NULL SID 

Account Name:		- 

Account Domain:		- 

Logon ID:		0x0 

Logon Type: 3

Account For Which Logon Failed:

Security ID:		NULL SID 

Account Name:		domadmin

Account Domain:		ad01 

Failure Information:

Failure Reason:		Unknown user name or bad password. 

Status:			0xC000006E 

Sub Status:		0xC000006E 

Process Information:

Caller Process ID:	0x0 

Caller Process Name:	- 

Network Information:

Workstation Name:	L01-NS-L-WN022

Source Network Address:	10.8.0.2 

Source Port:		0 

Detailed Authentication Information:

Logon Process:		NtLmSsp  

Authentication Package:	NTLM 

Transited Services:	- 

Package Name (NTLM only):	- 

Key Length:		0

Connecting from another Client with Windows 11 23H2 with the same Credentials works normally.

We were also able to replicate it with another Client that we upgraded to Windows 11 24H2.

Did anyone else also notice this behaviour?

Answer 1

Hello,

Thanks for your reply. We dont have any special settings on our Accounts or Active Directory for the kerberos pre-authentication.

But i have now found a way to connect with RDP to the Servers again. We simply need to write the username like this:

domain\username

Instead of the UPN username@domain

Kind Regards

Marcel

Answer 2

Hello,

Thank you for posting in the Microsoft Community Forums.

Windows 11 24H2 does not support NTLMv1, and it enforces the use of NTLMv2 or Kerberos for authentication.

For RDP connections, if the user is a member of the "Protected Users" group, NTLM authentication is not possible, and Kerberos should be used. However, if Kerberos pre-authentication fails, it could be due to issues with the encryption type or configuration settings. Ensure that the registry key for the default pre-authentication encryption type is set correctly, and consider using AES instead of RC4.

I hope the information above is helpful.

Best regards

Yanhong Liu

Answer 3

Hi,

Thanks for your reply and sharing.

I'm glad your problem has been solved.

Best regards

Yanhong Liu

Answer 4

We had the same issue and where still searching till we came up to this post.
Thank you sir for your findings!

I really hope someone of Microsoft forwards this to the correct team for debugging in the Windows 11 24H2 release since using the UPN should be the default way as described in many articles.