search

Thinstation / thinstation

A framework for making thin and light Linux based images for x86 based machines and thinclients.
https://www.thinstation.net/
793 stars 187 forks source link

Problem to login to RDP 2016, when user have domain flag "User must to change domain password at next login" #677

Closed presto8810 closed 2 years ago

presto8810 commented 2 years ago

Hi Don. In topic situation i just get message "Click YES to reconnect". I think the problem in Kerberos. You have some idea how fix this issue without disabling domain policy to change user password once per 3 months???

Thinstation commented 2 years ago

What is the exit code?

presto8810 commented 2 years ago

NLA in required by server. image

i connect with next options SESSION_1_TITLE="Remote Desktop" SESSION_1_TYPE=freerdp SESSION_1_FREERDP_SERVER=rdpd.NISSAN.local SESSION_1_FREERDP_OPTIONS="/d:NISSAN.local /sound:sys:alsa /microphone:sys:alsa /cert-ignore /sec:nla /gfx:AVC444 /gdi:sw /a:drive,redirect,/mnt/usbdevice" SESSION_1_AUTOSTART=On

presto8810 commented 2 years ago

IF i desible NLA on Server and change option /sec:nla to -sec-nla, RDP session is starting and i get windows prompt to change password: image

Thinstation commented 2 years ago

Possibly we could capture the error and present the user with a dialog notifying them that there password must be changed, but there won't be any possibility to change the password through the dialog.

presto8810 commented 2 years ago

Yes! I found some information at different forums. Support of WTware says if Admin want to use NLA, its needs to change users domain passwords at another place (https://rdr-it.com/en/change-password-from-the-interface-rdweb/) but it is need to make some PC or thin machine with browser. HP ThinPro can change domain password by adding machine to domain and domain pre-authentication with domain credentials before RDP session, and take user and pass from pre-auth data.

Well enywhere, if i want to use thinstations there only two ways: disabling NLA, or buid bysicle with additional machine and kiosk browser for change users password like this way https://rdr-it.com/en/change-password-from-the-interface-rdweb/ ??

Thinstation commented 2 years ago

Try the changes I just pushed.