Using Remote Desktop, connect to a Windows 7 domain user account without first logging on locally?

Question

I have a dell laptop (henceforth we'll call this the server) running Windows 7 Enterprise. The server is part of my company's domain. My primary user account is a domain account.

When I am at home and not connected to the domain, I prefer to connect to the server using Remote Desktop Connection from my MacBook Pro (we'll call this the client). The problem is, that if I do not physically login to the server, I am unable to connect to it using RDC from the client.

I have a local administrator account on the server, and connecting to it via RDC works just fine.

I had a feeling that the Mac RDC application was not giving me the full story, so I attempted the same procedure from a Windows 7 client. When trying to login, I get this message:

An authentication error has occured.
The local security authority cannot be contacted.

So basically, If I logon to the server physically with my domain user and lock the computer, I can then successfully logon from the client. Otherwise, I am unable to connect.

Solution 1

There are two things you should check:

1. Your domain user has to be in the local group Remote Desktop Users or Administrators(on the server)
2. Check the security policies on the server with Local Security Policy(secpol.msc). Make sure your user is not in Deny log on through Remote Desktop Services. You find this in Local Policies\User Rights Assignment

Usually you don't have to check the policy Allow log on through Remote Desktop Services because the Remote Desktop Users are already added to this one. Those policies could be managed through your domain which would not allow you to make any changes.

Solution 2

From my experience, you cannot log onto a system remotely with a domain account using cached credentials.

The server (not necessarily the client) needs to be able to authenticate remote users with a Domain Controller in order to allow them access. Locally logged-in users are exempt from this requirement. Why there is a difference, or if there is a way around this, I do not know.

I've run into this before, when I take a laptop (running Server 2003 or 2008) out to a remote site where I am behind a firewall that does not allow my system to reach any Domain Controllers. Other systems on the network are configured to be able to communicate with DCs, but not mine. Under these conditions, using cached credentials, I can log in locally to my laptop with my domain account just fine. I can also log in remotely, with my domain account, to any system on the network that's able to communicate with the DCs.

However, coming from one of those networked systems, I cannot log in remotely to my laptop with my domain account while it cannot communicate with the DCs. At this point, my domain account is in the local Administrators group and I usually have a locally logged-in session already running.

Solution 3

Does the domain user have a "Log On To..." restriction set within the account tab for the user setup? I've received a similar error when using such an account.

Also I've had a case where a content filter appliance would not allow inbound requests (from a remote user with VPN) to Windows 7 computer but would allow outbound connections from host computer to remote laptop. Once the outbound connection was established then the inbound request could be resent and the connection would function as expected.

Comments

[Ben Voigt]

Is Fast User Switching enabled? I remember Vista could only handle multiple logon session with FUS enabled, and I'm not sure if Win7 changes this.

[Ben Voigt]

Wait... what OS is the server? You've told us a lot about your clients and almost nothing about the server, which is the common point of failure.

[Robert S Ciaccio]

@BenVoigt: "a dell laptop (henceforth we'll call this the server) running Windows 7 Enterprise."

[Ben Voigt]

@calavera: Sorry, my brain just refused to process "laptop == server".

[Robert S Ciaccio]

@BenVoigt: Fast user switching is enabled, but no other accounts are logged on.

[HonanLi]

If the domain account is not an Administrator because of company policy, make sure that the user is in the Remote Desktop Users group. Once you have verified that the user is in this group, make sure you are putting the domain in the "domain field" in RDP for Mac or YourDomain\username in the User Name field...

[HonanLi]

If this setting is enabled, you can press CTRL+ALT+END and it will send CTRL+ALT+DEL to the remote system and you can then log in.