Registry Tweak Restores Connection to a Remote Windows 2008 Server

I recently faced a problem when trying to connect to a remote Windows Server 2008 server. I initially tried to connect with Remote Desktop Connection but was unsuccessful. Next, I tried to connect with the Microsoft Management Console (MMC) Remote Desktops snap-in, but the session was immediately disconnected. A quick ping test revealed that the server was running, so I decided to see whether I could use the Server Message Block (SMB) protocol to connect to an administrative share (C$). I successfully connected to the share.

Because the Server 2008 machine wasn't a critical server, decided to use the Shutdown command from my desktop to remotely shut it down. After rebooting, I tried both the Remote Desktops snap-in and Remote Desktop Connection with no luck. However, this time I received the following error message that proved helpful: The remote computer requires Network Level Authentication, which your computer does not support.

I don't use Network Level Authentication (NLA), so my Server 2008 machines are configured to allow connections from computers running any version of Remote Desktop Connection. (Curiously, even Remote Desktop Connection 6.0 doesn't support NLA on Windows XP.) However, for a reason I couldn't figure out, my remote server had reconfigured itself to accept only NLA RDP connections.

Physically visiting the remote Server 2008 machine to reconfigure the relevant option wasn't feasible, so I searched for an alternative. After I investigated some solutions, I had an idea: I'd try to tweak the remote server's registry to change the option.

After some research on the Internet, I found a blog—"Programmatically Determining Terminal Server Mode on Windows Server 2008"—that discusses remote desktop registry settings. So I opened regedit and connected to the remote server's registry. I then navigated to HKLMSystemCurrentControlSetControlTerminal Server and verified that fDenyTSConnections entry was already set to 0.

The SecurityLayer entry under HKLMSystemCurrentControlSetControlTerminal ServerWinStationsRDP-Tcp was already set to 1, but the UserAuthentication entry was set to 1. That's the reason I couldn't connect. I changed the value to 0.

After making this registry tweak, I tried to connect the remote server. This time, I successfully made the connection.