OpenTC Development - Revision history

Dan at 02:20, 7 May 2025

2025-05-07T02:20:15Z

Dan at 01:54, 7 May 2025

2025-05-07T01:54:37Z

Dan at 23:05, 27 April 2025

2025-04-27T23:05:14Z

Dan: /* Certificate/publisher warning */

2025-04-27T23:05:02Z

Certificate/publisher warning

Dan at 00:29, 22 October 2021

2021-10-22T00:29:03Z

Dan at 00:27, 22 October 2021

2021-10-22T00:27:03Z

Dan: /* Certificate/publisher warning */

2021-10-21T02:11:00Z

Certificate/publisher warning

Dan: /* Certificate/publisher warning */

2021-10-21T02:09:08Z

Certificate/publisher warning

Dan: /* Certificate/publisher warning */

2021-10-21T02:03:24Z

Certificate/publisher warning

Dan at 01:51, 21 October 2021

2021-10-21T01:51:46Z

@@ Line 38: / Line 38: @@
   "fPromptForPassword"=dword:00000000
+===Trusted Connection===
 When there is no valid certificate, the Remote Desktop client will show a popup before connecting telling the user the identity of the remote computer or publisher cannot be verified.<br>
-This popup can be ignored to continue, however this would be an inconvenience to the end user and might give them a wrong impression.<br>
+Checking the "Don't ask me again for connections to this computer" box will create a value in the registry key "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Terminal Server Client\LocalDevices", with the name of the remote computer.<br>
 When using a custom RD Gateway server name, a different value will be created with both the computer name and server name separated by a semicolon (;).<br>
-The data of this value is an add up on what features in "Local Resources" are selected, here is a list of affected features;
+The data of this value is an add up on what features in "Local Resources" of the .rdp-file are selected, see the list of affected features and their value.<br>
 {| class="wikitable"
 |-
-! Setting !! File Value !! Data
+! Feature !! File Reference !! Trigger !! Value
 |-
-| Record from this computer || "audiocapturemode:i:1" || 128
+| Record from this computer || "audiocapturemode" || anything but '0' || 128
 |-
-| Printers || "redirectprinters:i:1" || 64
+| Printers || "redirectprinters" || anything but '0' || 64
 |-
-| Clipboard || "redirectclipboard:i:1" || 4
+| Clipboard || "redirectclipboard" || anything but '0' || 4
 |-
-| Ports || "redirectcomports:i:1" || 2
+| Ports || "redirectcomports" || anything but '0' || 2
 |-
-| Drives || "drivestoredirect:s:" (anything but empty) || 1
+| Drives || "drivestoredirect" || anything but empty || 1
 |-
-| Other supported PnP devices || "devicestoredirect:s:*" || 32
+| Other supported PnP devices || "devicestoredirect" || anything but empty || 32
 |}
 === Credentials ===
@@ Line 75: / Line 68: @@
 The OpenTC login form will save the entered credentials using cmdkey, and delete them after use.<br>
-In order for this to work, "prompt for credentials" in the .rdp file must be set to 0 ("Allow me to save credentials" checked, or "Always ask for credentials" unchecked).<br>
+In the .rdp file "prompt for credentials" must be '0' ("Allow me to save credentials" checked, or "Always ask for credentials" unchecked).<br>
 On the OpenTC computer, the "Prompt for credentials on the client computer" group policy must not be enabled.<br>
 On the remote computer, the "Always prompt for password upon connection" group policy must not be enabled.<br>

@@ Line 40: / Line 40: @@
-=Certificate/publisher warning=
+===Certificate/publisher warning===
 When there is no valid certificate, the Remote Desktop client will show a popup before connecting telling the user the identity of the remote computer or publisher cannot be verified.<br>
 This popup can be ignored to continue, however this would be an inconvenience to the end user and might give them a wrong impression.<br>
@@ Line 68: / Line 68: @@
 |}
 Having none of these features selected will result in the data of 0, but still requires the existence of the value. Having them all selected makes it 231.<br>
-EDIT: Latest test show Windows 10 always starts with the value of 8, making the maximum you can have 239.
+EDIT: Latest test show Windows 10 always starts with the value of 8, making the maximum you can have 239.<br>
-=Server mode=
+=== Credentials ===
-Without server mode, OpenTC is not able to check if a user has entered an incorrect password. Therefore when standalone mode is used and an incorrect password has been entered, the user will be prompted with Remote Desktop's own credential input form. This could have been avoided by creating a trigger when this form is being opened, whoever this requires Administrator right, something that we do not want to give the OpenTC local user account.<br>
+[https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/cmdkey cmdkey.exe] was introduced in Windows Vista and up, and can be used to save credentials that Remote Desktop Connection can use to login automatically.<br>
-Letting the client directly check via Active Directory was also not considered as an option, mainly because it would require working credentials to check AD in the first place, plus it would require plugins and a lot of code.<br>
+Before this, credentials could be saved inside the .rdp file (unsafe/slow), or else would have to be manually entered (annoying).<br>
-When server mode is used, the client will first send the credentials to the OpenTC server, the server will check the credentials against Active Directory, and will do other check like whether the account has been disabled locked or expired, or when the password has expired. When the latter is the case the server will return this to the client and the client will show a popup screen to change the password, which in turn will be send back to the server for them to be changed.<br>
+In order for this to work, "prompt for credentials" in the .rdp file must be set to 0 ("Allow me to save credentials" checked, or "Always ask for credentials" unchecked).<br>
+On the OpenTC computer, the "Prompt for credentials on the client computer" group policy must not be enabled.<br>
-=Smart card=
+On the remote computer, the "Always prompt for password upon connection" group policy must not be enabled.<br>

@@ Line 67: / Line 67: @@
 | Other supported PnP devices || "devicestoredirect:s:*" || 32
 |}
-Having none of these features selected will result in the data of 0, but still requires the existence of the value. Having them all selected makes it 231.
+Having none of these features selected will result in the data of 0, but still requires the existence of the value. Having them all selected makes it 231.<br>
 EDIT: Latest test show Windows 10 always starts with the value of 8, making the maximum you can have 239.

@@ Line 68: / Line 68: @@
 |}
 Having none of these features selected will result in the data of 0, but still requires the existence of the value. Having them all selected makes it 231.
 =Server mode=

@@ Line 26: / Line 26: @@
 ====Client Computer====
-The following Group Policy must not be enabled on the client computer:
+Make sure that the following Group Policy is not enabled on the client computer:
   Computer Configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Connection Client > "Prompt for credentials on the client computer"
 ====Remote Computer====
-The following Group Policy must not be enabled on the remote computer:
+Make sure that the following Group Policy is not enabled on the remote computer:
   Computer Configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Security > "Always prompt for password upon connection"
 ===Notes===
-It is reported that the following registry value would overwrite the "Allow me to save credentials" option for RDP files:
+It is reported that the following registry value would overwrite the "Allow me to save credentials" option for RDP files, this has not been tested yet.
   [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services]
   "fPromptForPassword"=dword:00000000

@@ Line 1: / Line 1: @@
 =Automatic login=
-The login screen where the credentials must be entered is a custom made form and is not related to any native Windows Remote Desktop functions.<br>
+The Remote Desktop Connection (mstsc.exe) client has the ability to automatically login without promping for credentials, when these are previously saved.<br>
-Therefore, the credentials entered in the form must somehow be passed down to establish a Remote Desktop connection without having to fill in it's own credentials form.<br>
+Credentials also can be added by using [https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/cmdkey cmdkey.exe], which OpenTC uses to 'pass down' the credentials entered in it's login form.<br>
-There are two ways to do this, one of them is to make your own Remote Desktop client by using some Remote Desktop DLL's inside your project. This option has not been chosen for OpenTC, since in order to make all it's features available you would have to completely rewrite the client like the native one.<br>
+Official documentation states that the correct way to use cmdkey.exe to save credentials for "Remote Access" is to use the /generic parameter instead of /add.<br>
-The other option is to fool Windows that the user has logged in before and used the "Remember me" option, causing it to automatically login without having to enter any credentials.<br>
+The "TERMSRV/" prefix to the target name exists to distinguish between user or gateway credentials.<br>
-Before this can happen the credentials must be loaded into the current user, this can be done by using the built-in application cmdkey<br>
+Not using this prefix will result in authentication failure in an uncommon scenario where these credentials are different on the same server.<br>
-When the Remote Desktop connection has been established, it would be ideal to remove the saved credentials as soon as possible. OpenTC is being run under one local user account and therefore shares the same saved credentials database for anyone that uses the client computer.<br>
+For security reasons, the credentials need to be removed as soon as possible after the connection has been established.
 ===Requirements===
-In order for this to work, the RDP-file would need to have a few settings set, this can by done with mstsc.exe or by opening the file with a text editor like Notepad.<br>
+In order for this to work smoothly, the RDP file and remote computer need to be configured to allowed for saved credentials.<br>
 "Allow me to save credentials" must be checked (when credentials are saved, this text will change to "Always ask for credentials", which in that case must be unchecked).
   prompt for credentials:i:0
@@ Line 29: / Line 25: @@
   promptcredentialonce:i:1
-Some Group Policies must also be compliant. By default these are already set this way, however make sure this hasn't been changed.<br>
+====Client Computer====
-On the client:
+The following Group Policy must not be enabled on the client computer:
-  Computer Configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Connection Client > "Prompt for credentials on the client computer": Not Configured / Disabled
+  Computer Configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Connection Client > "Prompt for credentials on the client computer"
-And on the host server:
-  Computer Configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Security > "Always prompt for password upon connection": Not Configured / Disabled
+====Remote Computer====
 ===Notes===

@@ Line 47: / Line 47: @@
 Years ago there used to be the ability to set a registry value telling the client to skip this check, however Microsoft patched this since they considered it a security risk.<br>
-We recommend that you setup your Remote Desktop Session Host, Connection Broker, Gateway, and RDP file the correct way.<br>
+We recommend that you setup your Remote Desktop Session Host, Connection Broker, Gateway, and RDP file the correct way.<br><br>
 Checking the "Don't ask me again for connections to this computer" box will create a value in the key "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\LocalDevices", with the name of the remote computer.<br>

@@ Line 42: / Line 42: @@
-=Certificate warning=
+=Certificate/publisher warning=
-When there is no (valid) certificate, the Remote Desktop client will show a popup before connecting telling the user the identity of the remote computer cannot be verified.<br>
+When there is no valid certificate, the Remote Desktop client will show a popup before connecting telling the user the identity of the remote computer or publisher cannot be verified.<br>
-This popup can be clicked away to continue, whoever this would be an inconvenience to the end user and might give them an unprofessional impression.<br>
+This popup can be ignored to continue, however this would be an inconvenience to the end user and might give them a wrong impression.<br>
-Years ago there used to be the ability to set a registry value telling the client to skip this check, whoever Microsoft patched this since it was concidered a security risk.<br>
+Years ago there used to be the ability to set a registry value telling the client to skip this check, however Microsoft patched this since they considered it a security risk.<br>
-We recommend that you issue your RDP file with a valid certificate, you can find instructions on how to do this.<br>
+We recommend that you setup your Remote Desktop Session Host, Connection Broker, Gateway, and RDP file the correct way.<br>
-When you do not have the ability to do this, the easiest way to get rid of this warning would be to edit your image (which you were probably going to do anyways to install OpenTC), and manually check "Don't ask me again for connections to this computer" at the popup screen, for each RDP file.<br>
+Checking the "Don't ask me again for connections to this computer" box will create a value in the key "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\LocalDevices", with the name of the remote computer.<br>
-We are still working on an automated process for this, but it seems that in order for the Remote Desktop client to remember you checked this box, it will add a value to the registry.<br>
+When using a custom RD Gateway server name, a different value will be created with both the computer name and server name separated by a semicolon (;).<br>
-This value is located in the registry key "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\LocalDevices", the name of the value is the name of the remote computer, and the value data seems like a random DWORD.
+The data of this value is based on what features in "Local Resources" are selected, this is a list of affected features;
 {| class="wikitable"
@@ Line 77: / Line 69: @@
 | Other supported PnP devices || "devicestoredirect:s:*"
 |}
+Having none of these features selected will result in the data of 0, having them all selected makes it 231.
 =Server mode=