Mac clients can RDP into server yet Windows clients are unable to connect

rdp

We have a Windows Server 2008 R2 system that can't be accessed remotely via RDC from windows systems (I've tried Windows 10, Windows 7, Windows 2012 R2 all without luck). Paradoxically, our SysAdmins who run MacBooks are able to connect using the MS RDP Client for Mac.

In examining a WireShark trace I see the following for sessions that fail:

  • Client – SYN
  • Server – SYN, ACK
  • Client – ACK
  • Client – RDP
  • Server – ACK
  • Server – RST, ACK

The 'RDP' Packet above has the following information:

  • TPKT Version 3
  • PDU Type: CR Connect Request
  • Type: RDP Negotiation Request
  • requestedProtocols: TLS security supported, CredSSP supported, Early User Authorization Result PDU Supported

For the Macs, I see a negotiation that looks like this:

  • Client – SYN, ECN, CWR
  • Server – SYN, ACK
  • Client – ACK
  • Client – RDP (Cookie:= .\username, Negotiate Request) [First Try]
  • Server – ACK
  • Server – RST, ACK
  • Client – SYN, ECN, CWR
  • Server – SYN, ACK
  • Client – ACK
  • Client – RDP (Cookie:= .\username, Negotiate Request) [Automatic retry]
  • (Normal RDP traffic, I can connect and it works)

The First try RDP packet looks like this:

  • TPKT Version 3
  • PDU Type: CR Connect Request
  • Type: RDP Negotiation Request
  • requestedProtocols: TLS security supported, CredSSP supported, Early User Authorization Result PDU Supported

The Automatic retry RDP packet drops the requestedProtocols:

  • TPKT Version 3
  • PDU Type: CR Connect Request
  • Type: RDP Negotiation Request
  • requestedProtocols: empty

At this point I'm trying to figure out how to get the windows RDP client to renegotiate like the Mac client. I've had no success yet. Has anyone had to contend with this before?

Additional context:

  • I have tried connecting from Windows 10 and Windows 7 with the same results
  • I am limited in that I can't change the RDP settings on the 2008 R2 server (extremely limited change control window).

Best Answer

As tends to happen to me, I stumble across the answer pretty quickly after posting a question. In talking with the System Administrators for the Windows Server in question I discovered:

  • TLS 1.0 was disabled to comply with security compliance requirements
  • RDP was configured to allow connections from any version of the RDP client (NLA was disabled)

With this information I discovered a blog post about How To Disable Credentials Prompt of RDP 6.0 which revealed 'hidden' settings that could be configured to address the problem.

Solution:

  • Save an RDP session to a .rdp file
  • Edit the .rdp file in a text editor (Notepad++ worked for me)

  • Add the following lines to the end of the file:

    negotiate security layer:i:0
authentication level:i:0
enablecredsspsupport:i:0 
prompt for credentials:i:0

  • Save the file

  • Double-click the .rdp file to open the connection.
Related Topic