RDP logon smart card requires two pin codes with enablecredsspsupport:i:0

Question

Hello forums!
We are working with a IT partner that have troubles on solving our RDP issue as an cry out for help i've turned to the forums.

We are looking into incorporating thin clients with smart cards into our environment.

Thin clients will start an RDP connection to our setup with no credentials supplied.
Logon window on connection broker asks for smart card pin code.
User supplies pin code.
User is routed to best terminal server.
Termanial server is now asking for the same smart card pin code.
User supplies pin code.
Logged on.

When user disconnects the session they can re-logon to the rdp without supplying double smart card pin codes.
However, when the user logged off they will get double pin codes.

I have also tested this on a PC, added enablecredsspsupport:i:0 to the rdp file. Same issue.

Our environment is:
1 RDP gateway (not used when using this as clients will be on network, no change if we enable it)
1 Connection broker
3 terminal servers.

All of them running 2019.

Any idéas?

Thanks
Best regards
Mattias

Answer 1

Hello @Mattias ,

The following link for your reference:
https://learn.microsoft.com/en-us/windows/security/identity-protection/smart-cards/smart-card-group-policy-and-registry-settings
https://duo.com/docs/rdp-faq

Answer 2

Thank you for the links. I've already read them but i can't find any topics on this particular issue.

Answer 3

Hello @Mattias ,

1.When did this issue occur?
2.Please enter command "get-hotfix" in Powershell to check if any patch is installed before the issue occurs;
3.If trying to connect to the session host from internal network without rdcb and rdgateway, will the issue still exist?
4.Check if the personal certificate expires in rdcb and rdgateway:

Answer 4

1. Never worked.
2. See above.
3. Still exists.
4. Many certs, need to check them. Will get back on this matter.

Also did try and logon using username and password. Get the same issue. Double logon, only when i use the enablecredsspsupport:i:0. If you remove this and connect it gets passed.

Answer 5

Hello @Mattias ,

Is there any progress on your side? You may also open a ticket to Microsoft for further professional help:
https://support.microsoft.com/en-us/help/4341255/support-for-busines