Query about connecting to network (RDC)

ben501

Probable quite straightforward, but the solution must be eluding the I.T. department.:huh:

Sometimes when I log on at work I'll get the message


The standard I.T. reply is to click the Don't ask again box, and it's sorted, but the warning keeps coming back day after day.

It's been going on for months now, but I decided that for the sake of a couple of mouse clicks every morning it wasn't worth the time & effort of trying to have it logged as a service request.
Then a few days ago I heard someone else mention that they had the same issue. My hopes of a solution were soon dashed when all the service engineer said was 'I'll see if I can find a fix on Google':eek: (I've tried myself & couldn't find anything, but then I was probably not asking the correct question) Still, it's not been fixed so I'm guessing I.T. couldn't find it either.


I know there are many I.T. people on the forum, so wondered if anyone can advise a solution? Either one I can apply myself, or if elevated privileges (or whatever the term is) are required, something I can pass on to those with the power to do it.

I think there are about 10 servers, and as far as I know I'm just connected to one at random each day. I don't get the message every day, so think some of the servers must be accepting the connection normally.

AndyPix

The proper way is for IT to install a propper certificate on the server that relates to the FQDN of the network.
(They will know what this means , or should do)


This is happening because you are connecting to a machine that has an earlier version of windows than your machine, so im guessing they are still on server 2003 (naughty naughty)


You can override this if you want to , although this is a drop in security so shouldnt really be done, the IT staff should install the proper cert.


But if you want to go ahead, open regedit as admin, and add the following :-


\\HKLM\Software\Microsoft\Terminal Server Client\AuthenticationLevelOverride (DWORD entry)
and set its value to 0

S0litaire

It's OK, the error is there because IT have skimped on the Certificate for the server connection. They are using a "Self Signed" certificate.

Self Signed ones are free and easy for the IT Dept. to create when required. These are usually OK for internal use.

You can get certificates which are "signed" by an outside authority. These are used in Customer facing servers. (like HTTPS sites) These cost a bit of £££ depending on who you get to sign them.

AndyPix

But the issue is that the user has to click this every time they connect, even after ticking the "dont ask again" box.


i realise there are "about 10 servers" but if the user has been facing this issue for months then they must have been on every server by now and should not keep getting asked the question.


If it were me, i would just click it each time, it isnt THAT much bother, however a workaround has been given above

John_Gray

That screen sometimes 'comes back' after several more weeks of remote controlling a PC - even though the box has been ticked.
I've never had it come back at every subsequent time, though.

Suggest to the IT Department that they Google for remote desktop certificate, perhaps adding Windows 7 (or whatever operating system you have) and they will come up with hits with information similar to that supplied above!

(Thanks for the registry entry, BTW, AndyPix!)

debitcardmayhem

perhaps the IT dept should distribute their p[STRIKE]ublic[/STRIKE]rivate cert to their users (over a secure link of course) and the users could then install that on their pcs, but what do I know

securityguy

Incompetent IT departments should be outsourced (and yes, I've been both a CIO and a CSO), In 2016, you have absolutely no excuse for telling staff to click through security warnings, ever. You cannot then complain when your staff fall for phishing attacks (often founded on connecting to websites whose certificates are broken and require you to override warnings) when you have a corporate policy of encouraging staff to click through those self-same security warnings.

It's trivial to fix certificate errors on internal networks: either get free Class 1 DV certificates from StartSSL or similar, which is easy and zero cost, or get a wildcard certificate, which will cost a couple of hundred but is even easier to deploy, or use an internal CA whose root certificate you install on your PCs, which doesn't require an invoice but is a pain in the !!!! to manage. If you're not competent to do that, resign. Because telling your staff to ignore screaming certificate warnings is appalling practice, and if you can't deal with that, what can you be trusted with?