There's something I don't get with RDP in a domain. During an authentication, if we're using a local account of the distant machine, then the creds are in the SAM so all good.

But with a domain account, how is done the comparison ? How does RDP authentication works in this case ?



RDP uses a protocol called CredSSP to delegate credentials. The process works like this.

  1. MSTSC prompts for credentials (or uses saved creds)
  2. MSTSC requests a network logon ticket (Kerberos or NTLM) to the machine typed into the "computer" field using the credentials from (1)
  3. A TLS session is established with the remote machine (this is why you sometimes see the yellow dialog indicating the typed name doesn't match the certificate name)
  4. The ticket from (2) is sent to authenticate the client machine
  5. A response to the ticket from (2) is sent to client to authenticate the target machine
  6. An encryption key is negotiated between the client and server
  7. The client encrypts the credentials typed in (1)
  8. The target decrypts the credentials and passes them to the logon process
  9. The logon process does a Kerberos auth of those credentials and starts your desktop session

The last little bit is no different than when you walk up to a computer and type your credentials in physically. You can also substitute password with smart card or certificate.

The security of this exchange lies in the fact that you used Kerberos to verify the identity of the target machine is one you trust because the name matches a service in Active Directory (yes, you're delegating that trust decision, but if you can't trust AD you're screwed anyway).

  • Ok ! Knew it was CredSSP, but didn't know if and where NTML/Kerberos took place to ask DCs for the right to login. Thanks a lot for this great procedural explanation !! – Daycopo Apr 6 '20 at 16:32

User's domain credentials are stored in the remote machine LSASS, indeed if it can't be reached succesfully, following error will show up:

Remote Desktop Connection: An authentication error has occurred. The Local Security Authority cannot be contacted Remote Computer: hostname or ip

This technical article from MS will give specifics about Remote Desktop Protocol authentication process.

  • Hey ! Thanks for the answer but actually fyi I think this is kinda wrong. LSASS stores creds only during the time of a session, and LSA is basically what manages all authentication requests telling what to do with what protocol. Your answer is about credentials storage, but my question was more about pure RDP authentication ! Peace :) – Daycopo Apr 6 '20 at 16:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.