{"id":1649,"date":"2025-10-26T23:51:33","date_gmt":"2025-10-26T23:51:33","guid":{"rendered":"https:\/\/www.ultrexstaff.com\/?p=1649"},"modified":"2025-10-27T04:28:21","modified_gmt":"2025-10-27T04:28:21","slug":"how-to-configure-rdp-when-remotely-connecting-to-an-entra%e2%80%91enrolled-device-windows-10-11","status":"publish","type":"post","link":"https:\/\/www.ultrexstaff.com\/?p=1649","title":{"rendered":"How to Configure RDP when Remotely Connecting to an Entra\u2011Enrolled Device (Windows 10\/11)"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">How to Configure RDP when Remotely Connecting to an Entra\u2011Enrolled Device (Windows&nbsp;10\/11)<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">\ud83d\udccc Overview<\/h3>\n\n\n\n<p>These steps describe how to configure Remote Desktop (RDP) to successfully connect to a Microsoft Entra\u202fID (Azure AD) joined device over VPN or office network. This includes editing the&nbsp;<code>.rdp<\/code>&nbsp;connection file and optionally editing the Windows&nbsp;<strong>hosts<\/strong>&nbsp;file on the VPN client to resolve NetBIOS or FQDN names more reliably.<\/p>\n\n\n\n<p>Heavily based on these three articles and built from&nbsp;<a href=\"https:\/\/app2.atera.com\/new\/ticket\/2571\" target=\"_blank\" rel=\"noreferrer noopener\">ticket #2571<\/a><\/p>\n\n\n\n<p>Especially useful for Santiam Water Control District staff.<br><br><a href=\"https:\/\/learn.microsoft.com\/en-us\/windows\/client-management\/client-tools\/connect-to-remote-aadj-pc\" target=\"_blank\" rel=\"noreferrer noopener\">https:\/\/learn.microsoft.com\/en-us\/windows\/client-management\/client-tools\/connect-to-remote-aadj-pc<\/a><\/p>\n\n\n\n<p><a href=\"https:\/\/rublon.com\/blog\/how-to-rdp-into-azure-ad-joined-vm\">https:\/\/rublon.com\/blog\/how-to-rdp-into-azure-ad-joined-vm<\/a><\/p>\n\n\n\n<p><a href=\"https:\/\/www.howtogeek.com\/27350\/beginner-geek-how-to-edit-your-hosts-file\">https:\/\/www.howtogeek.com\/27350\/beginner-geek-how-to-edit-your-hosts-file<\/a><\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">\u2705 Requirements &amp; Prerequisites<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Remote device:<\/strong>\u00a0Windows\u00a010 version 1809 or later, or Windows\u00a011 (with Oct\u20112022 cumulative update or newer) joined to Microsoft Entra ID. (<a href=\"https:\/\/learn.microsoft.com\/en-us\/entra\/identity\/devices\/howto-vm-sign-in-azure-ad-windows?utm_source=chatgpt.com\">Microsoft Learn<\/a>,\u00a0<a href=\"https:\/\/learn.microsoft.com\/en-us\/windows\/client-management\/client-tools\/connect-to-remote-aadj-pc?utm_source=chatgpt.com\">Microsoft Learn<\/a>)<\/li>\n\n\n\n<li><strong>Local client device:<\/strong>\u00a0Running Windows\u00a010 or 11. It can be Entra joined, hybrid joined, registered, or even part of a different AD domain. (<a href=\"https:\/\/learn.microsoft.com\/en-us\/windows\/client-management\/client-tools\/connect-to-remote-aadj-pc?utm_source=chatgpt.com\">Microsoft Learn<\/a>)<\/li>\n\n\n\n<li>Ensure the remote device (host) is configured to allow RDP: under Settings \u2192 System \u2192 Remote Desktop, \u201cAllow Remote Desktop connections\u201d is enabled. (<a href=\"https:\/\/learn.microsoft.com\/en-us\/windows\/client-management\/client-tools\/connect-to-remote-aadj-pc?utm_source=chatgpt.com\">Microsoft Learn<\/a>)<\/li>\n\n\n\n<li>If enabling Azure AD authentication, the remote device doesn\u2019t need Network Level Authentication enforced; indeed disabling NLA may be required for this use case. (<a href=\"https:\/\/learn.microsoft.com\/en-us\/answers\/questions\/1257878\/connect-to-azuread-joined-computer-over-rdp?utm_source=chatgpt.com\">Microsoft Learn<\/a>)<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">\ud83d\udee0 Step 1 \u2013 Edit the&nbsp;<code>.rdp<\/code>&nbsp;file<\/h2>\n\n\n\n<ol class=\"wp-block-list\">\n<li>On your local client, launch\u00a0<strong>Remote Desktop Connection<\/strong>\u00a0(<code>mstsc.exe<\/code>), enter the hostname (NOT the IP Address, often fails in this setup) of the remote device, expand\u00a0<strong>Show Options<\/strong>, and click\u00a0<strong>Save As\u2026<\/strong>\u00a0to store a\u00a0<code>.rdp<\/code>\u00a0file locally. (<a href=\"https:\/\/stackoverflow.com\/questions\/62307900\/remote-machine-is-aad-but-the-logon-attempt-failed?utm_source=chatgpt.com\">Stack Overflow<\/a>)<\/li>\n\n\n\n<li>Open the saved\u00a0<code>.rdp<\/code>\u00a0file using a text editor like Notepad.<\/li>\n\n\n\n<li><strong>Update<\/strong>\u00a0the\u00a0<code>full address:s:<\/code>\u00a0field to use the\u00a0<strong>NetBIOS hostname<\/strong>\u00a0or\u00a0<strong>FQDN<\/strong>, not the IP address. Example:<code>full address:s:Desktop\u2011Manager <\/code>(Replaces earlier\u00a0<code>s: \\\\192.168.1.119<\/code>\u00a0usage.) (<a href=\"https:\/\/ronamosa.io\/docs\/archive\/2017-09-12-Windows10Pro-RDP-AzureADJoined\/?utm_source=chatgpt.com\">ronamosa.io<\/a>)<br>Your internal ticket notes confirm that Azure AD\u2013joined devices\u00a0<strong>cannot<\/strong>\u00a0be reached by IP if using Azure AD authentication\u2014they require name resolution.<br><code>enablecredsspsupport:i:0 authentication level:i:2 <\/code>This disables CredSSP and sets a proper authentication level for Azure AD RDP login. (<a href=\"https:\/\/stackoverflow.com\/questions\/62307900\/remote-machine-is-aad-but-the-logon-attempt-failed?utm_source=chatgpt.com\">Stack Overflow<\/a>)<\/li>\n\n\n\n<li>Additionally, to enable Microsoft Entra (Azure AD) authentication prompt\u00a0<strong>via RDP<\/strong>, add (or change) the following:<code>enablerdsaadauth:i:1 <\/code>This flag ensures the client uses the web-account sign\u2011in flow. Without it, authentication via Azure AD may fail. (<a href=\"https:\/\/learn.microsoft.com\/en-us\/answers\/questions\/2238811\/some-users-unable-to-connect-to-azure-virtual-desk?utm_source=chatgpt.com\">Microsoft Learn<\/a>)<\/li>\n\n\n\n<li>Save the file and double-click it to initiate RDP.<\/li>\n\n\n\n<li>At credential prompt, enter your username in full UPN format:<code>username@domain.com<\/code>You will be prompted to fully sign in through a popup Microsoft login window and approve this new host; accept it. (<a href=\"https:\/\/rublon.com\/blog\/how-to-rdp-into-azure-ad-joined-vm\/?utm_source=chatgpt.com\">Rublon<\/a>,\u00a0<a href=\"https:\/\/learn.microsoft.com\/en-us\/windows\/client-management\/client-tools\/connect-to-remote-aadj-pc?utm_source=chatgpt.com\">Microsoft Learn<\/a>)<\/li>\n<\/ol>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">\ud83e\uddea Step 2 \u2013 (Optional) Add the Azure AD user to the Remote Desktop Users group<\/h2>\n\n\n\n<p>If you are not already part of the Remote Desktop Users group on the remote device, you may need to add your account or Azure AD group to it via&nbsp;<strong>local admin<\/strong>&nbsp;or&nbsp;<strong>MDM policy<\/strong>:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Using\u00a0<strong>Command Prompt<\/strong>\u00a0(as administrator):<code>net localgroup \"Remote Desktop Users\" \/add \"AzureAD\\username@domain.onmicrosoft.com\"<\/code><\/li>\n\n\n\n<li>Or using\u00a0<strong>PowerShell<\/strong>:<code>Add-LocalGroupMember -Group \"Remote Desktop Users\" -Member \"AzureAD\\username@domain.com\" <\/code>(<a href=\"https:\/\/www.prajwaldesai.com\/add-azure-ad-user-to-remote-desktop-users\/?utm_source=chatgpt.com\">Prajwal Desai<\/a>)<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">\ud83e\udded Step 3 \u2013 (Optional) Edit the hosts file for name resolution over VPN<\/h2>\n\n\n\n<p>When your client cannot resolve NetBIOS names over a VPN Connection or Wi\u2011Fi, you can manually define them:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>On the\u00a0<strong>remote client machine<\/strong>, open the hosts file in an elevated editor. Search for Notepad and\u00a0<strong>Run as Administrator > File > Open<\/strong>\u00a0to the following path:<code>C:\\Windows\\System32\\drivers\\etc\\hosts<\/code><\/li>\n\n\n\n<li>Add entries mapping internal device names to their IP addresses:<code>192.168.1.119 Desktop\u2011Manager<\/code><\/li>\n\n\n\n<li>Save the file. This allows the host name used in your\u00a0<code>.rdp<\/code>\u00a0file to resolve correctly even if DNS or NetBIOS resolution fails.<\/li>\n<\/ol>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">\ud83e\udde9 Troubleshooting Scenarios &amp; Notes<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>VPN client cannot ping or resolve NetBIOS name<\/strong>: may stem from missing NetBIOS over TCP\/IP setting, wireless isolation, subnet differences, or routing rules. Ensure NetBIOS over TCP\/IP is enabled in adapter IPv4 \u2192 Advanced \u2192 WINS tab, and review network isolation settings.<\/li>\n\n\n\n<li><strong>RDP fails using IP address<\/strong>: Azure AD joined devices require name (hostname or FQDN). IP\u2011only connections do not support the Azure AD authentication flow; using a host\u2011mapped name is required. (<a href=\"https:\/\/learn.microsoft.com\/en-us\/answers\/questions\/2070068\/issue-with-aad-login-into-azure-vm-joined-to-a-dif?utm_source=chatgpt.com\">Microsoft Learn<\/a>,\u00a0<a href=\"https:\/\/learn.microsoft.com\/en-us\/windows\/client-management\/client-tools\/connect-to-remote-aadj-pc?utm_source=chatgpt.com\">Microsoft Learn<\/a>)<\/li>\n\n\n\n<li><strong>NLA required<\/strong>: if NLA is enforced, Azure AD authentication may fail; ensure the remote device has NLA\u00a0<strong>disabled\u00a0<\/strong>if running into connection issues. (<a href=\"https:\/\/learn.microsoft.com\/en-us\/answers\/questions\/1257878\/connect-to-azuread-joined-computer-over-rdp?utm_source=chatgpt.com\">Microsoft Learn<\/a>,\u00a0<a href=\"https:\/\/www.niallbrady.com\/2017\/08\/23\/how-can-i-rdp-to-an-azure-ad-joined-windows-10-device\/?utm_source=chatgpt.com\">niallbrady.com<\/a>,\u00a0<a href=\"https:\/\/learn.microsoft.com\/en-us\/windows\/client-management\/client-tools\/connect-to-remote-aadj-pc?utm_source=chatgpt.com\">Microsoft Learn<\/a>)<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\"><\/h2>\n\n\n\n<h2 class=\"wp-block-heading\">\u2705 Example&nbsp;<code>.rdp<\/code>&nbsp;snippet<\/h2>\n\n\n\n<p>Note: some of these are already added in, so only copy and paste the missing ones and change the relevant entries.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>full address:s:Desktop\u2011Manager\nenablecredsspsupport:i:0\nauthentication level:i:2\nenablerdsaadauth:i:1\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">\u2139\ufe0f Why these settings matter<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>enablerdsaadauth:i:1<\/strong>\u00a0toggles the web\u2011account Azure AD login experience, prompting or allowing authentication through Entra ID. Without it, RDP will not negotiate Azure AD credentials correctly. (<a href=\"https:\/\/learn.microsoft.com\/en-us\/answers\/questions\/2238811\/some-users-unable-to-connect-to-azure-virtual-desk?utm_source=chatgpt.com\">Microsoft Learn<\/a>)<\/li>\n\n\n\n<li><strong>enablecredsspsupport:i:0<\/strong>\u00a0avoids CredSSP pitfalls that block Azure AD authentication, especially when Network Level Authentication isn&#8217;t compatible with Entra\u2011based tokens. (<a href=\"https:\/\/stackoverflow.com\/questions\/62307900\/remote-machine-is-aad-but-the-logon-attempt-failed?utm_source=chatgpt.com\">Stack Overflow<\/a>)<\/li>\n\n\n\n<li><strong>authentication level:i:2<\/strong>\u00a0is the required setting for secure fallback when CredSSP is disabled. (<a href=\"https:\/\/stackoverflow.com\/questions\/62307900\/remote-machine-is-aad-but-the-logon-attempt-failed?utm_source=chatgpt.com\">Stack Overflow<\/a>)<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">\ud83d\udccc Final Notes<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Always ensure both client and remote satisfy Windows update and version prerequisites for Azure AD RDP support. (<a href=\"https:\/\/learn.microsoft.com\/en-us\/entra\/identity\/devices\/howto-vm-sign-in-azure-ad-windows?utm_source=chatgpt.com\">Microsoft Learn<\/a>)<\/li>\n\n\n\n<li>Use FQDN or hostname resolution rather than IP when targeting Entra\u2011joined devices, especially in VPN environments.<\/li>\n\n\n\n<li>The hosts file edit can be a reliable workaround when DNS or NetBIOS resolution fails.<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>How to Configure RDP when Remotely Connecting to an Entra\u2011Enrolled Device (Windows&nbsp;10\/11) \ud83d\udccc Overview These steps describe how to configure Remote Desktop (RDP) to successfully connect to a Microsoft Entra\u202fID (Azure AD) joined device over VPN or office network. This includes editing the&nbsp;.rdp&nbsp;connection file and optionally editing the Windows&nbsp;hosts&nbsp;file on the VPN client to resolve [&hellip;]<\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[116,121,120],"tags":[],"class_list":["post-1649","post","type-post","status-publish","format-standard","hentry","category-intune-and-entra","category-networking","category-windows","post-preview"],"_links":{"self":[{"href":"https:\/\/www.ultrexstaff.com\/index.php?rest_route=\/wp\/v2\/posts\/1649","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.ultrexstaff.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.ultrexstaff.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.ultrexstaff.com\/index.php?rest_route=\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/www.ultrexstaff.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1649"}],"version-history":[{"count":2,"href":"https:\/\/www.ultrexstaff.com\/index.php?rest_route=\/wp\/v2\/posts\/1649\/revisions"}],"predecessor-version":[{"id":1683,"href":"https:\/\/www.ultrexstaff.com\/index.php?rest_route=\/wp\/v2\/posts\/1649\/revisions\/1683"}],"wp:attachment":[{"href":"https:\/\/www.ultrexstaff.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1649"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.ultrexstaff.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1649"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.ultrexstaff.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1649"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}