As schools start to deploy InTune managed Windows10 desktop with an Azure based user directory a few interesting challenges emerge.
One of these is remote support of Azure joined Windows10 desktops using the RDP client. Using the default settings, the Azure AD (AAD) account credentials are rejected by the client dialog which stops the process in its tracks.
So how can you RDP into an Azure joined Windows10 device using your AAD user permissions?
The first job is to disable Network Level Authentication (NLA) for Remote Desktop Connection on the target Windows 10 computer.
Open System Properties and navigate to the Remote tab. Under Remote Desktop make sure Allow remote connections to this computer is enabled, and that Allow connections only from computers running Remote Desktop with Network Level Authentication is unchecked.
The second task is to edit the .rdp file you are using for the connection so it looks like this
full address:s:<ip address>:3389
enablecredsspsupport:i:0
authentication level:i:2
These settings disable any credentials being sent to the host computer. As a result the host will be forced to present the logon screen rather trying to create the session prior to connection. This way you have the opportunity to present your AAD account details.
Now you will find that entering the AAD details in the logon box will open up a desktop. This works fine with all accounts that have local admin rights but what if you try with a standard user account. You’ll find you get a rejection notice informing you that the user does not have the rights to a remote session which is expected as they are not a member of the Remote Desktop Users local group.
Opening up Local Users and Group MMC console on the console doesn't help you as there’s no way of selecting Azure AD as a source. Fortunately you can add users from Powershell.
Open up a powershell session with admin privileges and type.
net localgroup “Remote Desktop Users” /add "AZUREAD\JoeShmoe@yourdomain.com"
You should get a “Command successful” and the user account will be listed as a member in the Local Users and Group MMC console. The next RDP session will work as expected. The same technique works for any local group that needs to transfer Azure AD account rights.
One of these is remote support of Azure joined Windows10 desktops using the RDP client. Using the default settings, the Azure AD (AAD) account credentials are rejected by the client dialog which stops the process in its tracks.
So how can you RDP into an Azure joined Windows10 device using your AAD user permissions?
The first job is to disable Network Level Authentication (NLA) for Remote Desktop Connection on the target Windows 10 computer.
Open System Properties and navigate to the Remote tab. Under Remote Desktop make sure Allow remote connections to this computer is enabled, and that Allow connections only from computers running Remote Desktop with Network Level Authentication is unchecked.
The second task is to edit the .rdp file you are using for the connection so it looks like this
full address:s:<ip address>:3389
enablecredsspsupport:i:0
authentication level:i:2
These settings disable any credentials being sent to the host computer. As a result the host will be forced to present the logon screen rather trying to create the session prior to connection. This way you have the opportunity to present your AAD account details.
Now you will find that entering the AAD details in the logon box will open up a desktop. This works fine with all accounts that have local admin rights but what if you try with a standard user account. You’ll find you get a rejection notice informing you that the user does not have the rights to a remote session which is expected as they are not a member of the Remote Desktop Users local group.
Opening up Local Users and Group MMC console on the console doesn't help you as there’s no way of selecting Azure AD as a source. Fortunately you can add users from Powershell.
Open up a powershell session with admin privileges and type.
net localgroup “Remote Desktop Users” /add "AZUREAD\JoeShmoe@yourdomain.com"
You should get a “Command successful” and the user account will be listed as a member in the Local Users and Group MMC console. The next RDP session will work as expected. The same technique works for any local group that needs to transfer Azure AD account rights.
No comments:
Post a Comment