remote desktop problem

[cindylee]

Hi
I have an XP Pro SP2 computer. In the security policy for this machine, I have defined "Interactive Logon: Message Text for Users Attempting to Log On", and included text that gets displayed before a user can log in. The problem is when I am connected to that machine remotely ( using Remote Desktop), and I reboot it remotely, and then try to re-initiate a remote desktop connection (after it boots up),
I get a black screen. The only way I can get a logon prompt, is to go to the remote machine ( luckily it's in the next room) and acknowledge the Logon banner that I defined in the security policy. Then, my remote session springs to life, and it now displays the logon banner, and I can acknowledge it, and I am able to log in. Is this behaviour by design, or am I missing something. Obviously, I can disable the message text, but I'd like to understand what's going on. Also, it's a recommended security practice to have these logon banners......

 

[Rick998]

It's Catch 22. You can't RDP to a PC that doesn't have an account logged on to the operating system (and Windows networking) so you can't click on the 'OK' button in the 'interactive logon message text' in order to complete the startup/logon process.

This behaviour is by design as Terminal Services (which RDP is based on) expects an account to be logged on to the OS before being RDP'd to.

One way around this behaviour is to install a flavour of VNC (we use RealVNC, available from

http://www.realvnc.com/

but there's several out there). VNC and its derivatives can run as a system service.

In practice, this means that you can VNC into a PC and 'OK' the 'interactive logon message text' button. After Windows has finished starting up (loading a profile, etc.) then you can RDP into it and use the RDP strengths (local printing, shared drives, etc.).

Hope this helps...

 

[cindylee]

But when I disable the logon banner, and reboot the system, I'm able to logon using RDP, even though there's no other accounts logged on to the operating system ( cause it's just been rebooted )????

 

[Rick998]

If you disable the logon banner and reboot the system then you should continue to login automatically to the OS... unless there is more than one user account (not counting the Administrator account which, by default, is not shown).

Does this help...?

 

[cindylee]

I'm just confused about your first reply where you said that "You can't RDP to a PC that doesn't have an account logged on to the operating system (and Windows networking)".
That's what I did after I disabled the banner - I rebooted the XP machine and then, as it was still coming up, I went to my other computer and used RDP to log on to the XP machine remotely, and no other account was logged on.

 

[linney]

A couple of similar stories here, but no solution.

http://groups.google.com.au/group/m...+remote+desktop&rnum=4&hl=en#c982ffe242f005d6

http://groups.google.com.au/group/m...+remote+desktop&rnum=9&hl=en#014ced2853793326

http://groups.google.com.au/group/m...remote+desktop&rnum=11&hl=en#1e9a954cea7d6b77

Remote Desktop is described in detail in the Help and Support program under this heading "Remote Desktop overview".

280828 - How a Remote Desktop Connection Affects Windows XP Professional

http://support.microsoft.com/default.aspx?scid=kb;en-us;280828&FR=1&PA=1&SD=HSCH

The Features of the Remote Desktop Client in Windows XP

http://support.microsoft.com/default.aspx?scid=kb;en-us;300698&FR=1&PA=1&SD=HSCH

289289 - Remote desktop connection "The local policy of this system does not permit you to logon interactively"

http://support.microsoft.com/default.aspx?scid=kb;en-us;289289&FR=1&PA=1&SD=HSCH

 

[cindylee]

Thanks for the links - those describe what's happening with me too... We used to have Win2K Server installed, and Terminal Services worked so much better

 

[Rick998]

RDP will connect to a remote PC (with a challenge/response dialog) unless the remote PC has had a policy enforced on it which says, in effect, "don't logon (to the OS) until the following conditions are met".

You appear to have implemented a policy whereby the default login process has been halted by a legitimate 'Group Policy' challenge/response of 'who are you'.

 

[cindylee]

So, I'll assume then from what you said , that a logon banner is a "legitimate 'Group Policy' challenge/response of 'who are you' "? At least I know that I can work around the problem - not the greatest solution but.....
Thanks for all your help Rick998 : - )