HyperV Controller: Double Authentication Required for RDP Sessions

Hyper-V Controller: Double Authentication Required for RDP Sessions

Are you experiencing an issue where your domain controller, running in Hyper-V, requires double authentication when attempting to open an RDP session? This article will provide a detailed explanation of the issue and its solution, focusing on the global topic of Hyper-V and RDP sessions.

Context and Problem Description

When managing a domain controller running in a Hyper-V environment, you may encounter a problem where the RDP session continuously prompts for sign-in credentials, even after entering the correct information. This double authentication requirement can be frustrating and time-consuming.

Understanding the Issue

This issue arises due to the combination of two factors:

• The domain controller is running inside a Hyper-V virtual machine.
• The user account attempting to access the domain controller is a member of the local Administrators group.

The double authentication prompt for RDP sessions occurs because the user account is a member of the local Administrators group, which triggers User Account Control (UAC) to request elevated permissions. The UAC prompt appears after the initial sign-in request, giving the impression of double authentication.

Resolving the Double Authentication Issue

To resolve the double authentication issue for RDP sessions to a domain controller running in Hyper-V, follow these steps:

1. Log in to the Hyper-V host server.
2. Open the Hyper-V Manager and connect to the domain controller virtual machine.
3. Sign in using the domain administrator account.
4. Launch the Local Group Policy Editor (gpedit.msc).
5. Navigate to Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options.
6. Find the policy named User Account Control: Run all administrators in Admin Approval Mode and set it to Disabled.
7. Close the Local Group Policy Editor.
8. Restart the domain controller virtual machine for the changes to take effect.

The double authentication issue for RDP sessions to a domain controller running in Hyper-V is caused by the combination of the virtual machine environment and the user account being a member of the local Administrators group. By disabling the Admin Approval Mode policy in the Local Group Policy Editor, you can resolve this issue and streamline the RDP sign-in process.

References

• Microsoft. (2021). Implement Administrator Role Separation
• Microsoft. (2021). User Account Control Overview