802.1x user authentication RDP

Question

802.1x user authentication RDP

Handian Sudianto 7,421

If we use 802.1x with user authentication then RDP is not working?

0 comments

2 answers

Your answer

Answer 1

ABM 5

802.1X with user authentication only requires a user to log in before the device is granted network access. Since RDP requires network connectivity, remote connections cannot be established before the user authenticates. To enable RDP, configure machine authentication or machine + user authentication, so the computer has network access even before a user signs in.

0 comments

Answer 2

Daphne Huynh (WICLOUD CORPORATION) 985 Microsoft External Staff Moderator

Welcome to Microsoft Q&A Forum!

Based on your description, the answer is Yes. This is expected behavior when 802.1X is configured for User Authentication only.

When a user connects to a Windows device through Remote Desktop (RDP), the 802.1X supplicant may be unable to obtain the user's security token from the remote session. As a result, 802.1X authentication can fail, causing the network connection to drop and the RDP session to disconnect. Microsoft documents this as a known issue for Windows devices secured with 802.1X using user-only authentication. I would like to share the following recommended solutions that may help you.

To support RDP on an 802.1X-protected network, kindly recommend configuring one of the following authentication modes instead:

Computer Authentication
User or Computer Authentication

Using either of these options helps maintain network authentication during remote sessions and avoids the disconnection behavior seen with User Authentication only.

Additionally, please notes that devices connected through 802.1X may intermittently disconnect when the network authentication method is configured as User Authentication. In such cases, switching to User or Computer Authentication or Computer Authentication is the recommended workaround.

Reference: 802.1x user authentication fails when an RDS connection comes in - Windows Client | Microsoft Learn

Guidance for troubleshooting RDS session connectivity - Windows Server | Microsoft Learn

I hope this information helps clarify the behavior and points you in the right direction. Thank you for posting your question.

Handian Sudianto 7,421 Reputation points

2026-07-28T11:01:28.2766667+00:00

hi @Daphne Huynh (WICLOUD CORPORATION)

what pros and cons if we use user authentication, computer authentication?

Also whet will be used as primary authentication if we set user or computer authentication?
Daphne Huynh (WICLOUD CORPORATION) 985 Reputation points Microsoft External Staff Moderator

2026-07-29T09:16:25.9666667+00:00
Yes, there are important differences between User Authentication, Computer Authentication, and User or Computer Authentication when using 802.1X. The most appropriate choice depends on your organization's security requirements, access control model, and remote management needs.

1. User Authentication

In this mode, the network authenticates the user's credentials after sign-in.

Pros:

Network access is tied directly to the user's identity.

Different users on the same device can receive different network policies, VLAN assignments, or access permissions.

Useful in environments where authorization is primarily user-based.

Cons:

The device does not authenticate before user sign-in, which may limit access to resources required during startup.

Remote Desktop (RDP) scenarios may fail because the 802.1X supplicant cannot obtain the user's security token from the remote session. This is a known limitation of user-only authentication.

Please also notes that wireless clients configured for User Authentication may intermittently disconnect in certain RDP scenarios.

2. Computer Authentication

In this mode, the network authenticates the computer account or computer certificate, regardless of which user is signed in.

Pros:

Network connectivity is available before user logon.

Supports startup processes such as Group Policy processing, software deployment, and device management.

Works reliably with RDP because authentication is based on the device rather than the interactive user session. Specifically recommends Computer Authentication as a workaround for the RDP issue described above.

Generally, provides a more stable experience for remotely managed devices.

Cons:

Access decisions are based on the device identity rather than the individual user.

Multiple users on the same device typically receive the same level of network access unless additional controls are implemented.

3. User or Computer Authentication

This mode combines the benefits of both approaches and is often the most flexible configuration. And this is how it works:

Before a user signs in, the device authenticates using Computer Authentication.

After sign-in, Windows can authenticate using the User Authentication context.

This allows the device to maintain network connectivity while also supporting user-based policies.

Pros:

Supports pre-logon network access.

Supports user-based authorization after sign-in.

Compatible with RDP and avoids the disconnection issues associated with User Authentication only.

Provides a good balance between security, manageability, and user experience.

Cons: Slightly more complex to deploy and troubleshoot than a single authentication method.

4. Which authentication is used when "User or Computer Authentication" is selected?

There is no single permanent "primary" identity. The authentication method depends on the current state of the device:

Before user sign-in: the computer account is used for authentication.

After user sign-in: Windows can authenticate using the user account and apply user-based policies.

If a user session is unavailable (for example, during startup or certain remote access scenarios), the computer authentication context continues to provide network connectivity.

Therefore, in practice, Computer Authentication is established first, and User Authentication becomes available after logon.

For environments that require both RDP support and user-based access control, User or Computer Authentication is generally the recommended configuration because it avoids the RDP connectivity issues associated with User Authentication only while still allowing user-based policy enforcement after sign-in.
Handian Sudianto 7,421 Reputation points

2026-07-30T00:50:41.33+00:00

hi @Daphne Huynh (WICLOUD CORPORATION)

Noted, but for user auth and computer auth but for 'user or computer authentication' i have one query below.

Example user IT will get vlan 10 and sales will get vlan 20, and computer authentication will get vlan 100. How RDP can work? We need to RDP to the IP from vlan 100 right? So if the user login locally the IT user will have ip from vlan 10, then if want to RDP we need to enter using ip from vlan 100?