Access to the remote desktop

To access the remote desktop with an authenticator, the following is required:

• The standard Windows Remote Desktop Connection utility (mstsc.exe) on the device the connection is made from (the terminal client).
• The Windows Logon module installed on the device that requires remote access (the terminal server).
• The corresponding authentication provider installed on the device that requires remote access.
• When using Hardware OTP Provider, a hardware authentication device connected to the device the connection is made from.
• Network Level Authentication disabled on the device that requires access.

How to disable Network Level Authentication

In registry

1. Open Registry Editor.
2. Open Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services.
3. For the UserAuthentication parameter of the DWORD type, set the value 0.
4. For the MinEncryptionLevel parameter of the DWORD type, set the value 3.
5. For the SecurityLayer parameter of the DWORD type, set the value 0.

In Group Policy Editor

1. Open Group Policy Editor.
2. Open Computer Configuration → Administrative Templates → Windows Components → Remote Desktop Services → Remote Desktop Session Host → Security.
3. Disable the Require user authentication for remote connections by using Network Level Authentication policy.
4. Enable the Set client connection encryption level policy.
5. In the policy parameters, for the Encryption Level setting, select the High Level value.
6. Enable the Require use of specific security layer for remote (RDP) connections policy.
7. In the policy parameters, for the Security Layer setting, select the RDP value.

Warning

If Network Level Authentication (NLA) is disabled, the security level decreases. Therefore, we recommend that you use the RDP Windows Logon module to connect to the remote desktop.

You can also configure the concurrent operation of Windows Logon and RDP Windows Logon.

To connect to the remote desktop with an authenticator:

1. Start Remote Desktop Connection.
2. Enter the name or address of the device you need to access and click Connect.
3. In the Windows Security window, enter the account password and wait for the connection.
4. In the Windows login window that appears, select the account and the login method (the authenticator type) and authenticate.

Note

If random password generation is not enabled for the account, you can access the remote desktop with the domain password.

To avoid being prompted for the username and password when connecting to the remote desktop, you need to change the system settings. For more information, see the article Disabling the login and password request on the terminal client side.