Windows RDP fails with RemoteFX required

[Adevill20]

Hey everybody.
I need help please. I installed a self-hosted instance of Teleport and connected it via LDAPS to a small Windows domain. I executed the PowerShell script generated by Teleport and it worked as all the machines are listed in Resources. I also added the correct role to my user profile and I confirm the AD Group Policies were created and the RemoteFX requirements are enabled. The problem is when I try to connect to a device, I still get the "RemoteFX is required" error on all the targets.

What I verified:
GPOs exist and are applied
I also tried Local policies, but get the same error
No other error in the logs
No error in the Windows Event viewer

Teleport logs: (I replaced the domain name with x.y.z below for obvious reasons)

2024-11-01T17:18:27+01:00 INFO [AUDIT]     cert.create cert_type:user cluster_name:teleport.x.y.z code:TC000I ei:0 event:cert.create client_ip:10.1.2.3 expires:2024-11-02T03:09:35.001188791Z logins:[user1 -teleport-internal-join] prev_identity_expires:0001-01-01T00:00:00Z private_key_policy:none roles:[access editor auditor windows-desktop-admins] route_to_cluster:teleport.x.y.z teleport_cluster:teleport.x.y.z logins:[user1] usage:[usage:windows_desktop] user:user1 time:2024-11-01T16:18:27.597Z uid:160dbe8c-6284-498d-9ab2-1c6d25c6bd77 user_agent:grpc-go/1.64.1 events/emitter.go:288
2024-11-01T17:18:27+01:00 INFO [WINDOWS_D] initiating RDP client pid:2023.1 client_ip:10.1.2.3 desktop_name:DC2-x-y-z-4c3e1114 desktop_addr:10.1.1.20:3389 teleport_user:user1 desktop_addr:10.1.1.20:3389 ad:true session_id:28135b38-9f97-45f0-bf91-f47765496f9c screen_size:0x0 computer_name:DC2 kdc_addr:10.1.1.10 nla:false desktop/windows_server.go:905
2024-11-01T17:18:27+01:00 INFO [AUDIT]     windows.desktop.session.start addr.local:10.1.2.3 addr.remote:10.1.1.20:3389 allow_user_creation:false cluster_name:teleport.x.y.z code:TDP00I desktop_addr:10.1.1.20:3389 teleport.dev/computer_name:DC2 teleport.dev/dns_host_name:DC2.x.y.z teleport.dev/is_domain_controller:true teleport.dev/origin:dynamic teleport.dev/os:Windows Server 2022 Datacenter teleport.dev/os_version:10.0 (20348) teleport.dev/ou:OU=Domain Controllers,DC=x-y-z,DC=eu teleport.dev/windows_domain:x.y.z desktop_name:DC2-x-y-z-4c3e1114 ei:1 event:windows.desktop.session.start login:user1 nla:false private_key_policy:none proto:tdp sid:28135b38-9f97-45f0-bf91-f47765496f9c success:true time:2024-11-01T16:18:27.603Z uid:cdf770de-8c1a-4270-9141-ad0ab07dc263 user:user1 user_kind:1 windows_desktop_service:252df4f8-6329-48e0-bce7-da1e0f8a7955 windows_domain:x.y.z windows_user:user1 events/emitter.go:288
2024-11-01T17:18:27+01:00 INFO [WINDOWS_D] Rust RDP loop starting pid:2023.1 client_ip:10.1.2.3 desktop_name:DC2-x-y-z-4c3e1114 desktop_addr:10.1.1.20:3389 teleport_user:user1 desktop_addr:10.1.1.20:3389 ad:true session_id:28135b38-9f97-45f0-bf91-f47765496f9c screen_size:0x0 computer_name:DC2 kdc_addr:10.1.1.10 nla:false rdp_addr:10.1.1.20:3389 rdpclient/client.go:286
2024-11-01T17:18:27+01:00 INFO [WINDOWS_D] TDP input streaming starting pid:2023.1 client_ip:10.1.2.3 desktop_name:DC2-x-y-z-4c3e1114 desktop_addr:10.1.1.20:3389 teleport_user:user1 desktop_addr:10.1.1.20:3389 ad:true session_id:28135b38-9f97-45f0-bf91-f47765496f9c screen_size:0x0 computer_name:DC2 kdc_addr:10.1.1.10 nla:false rdp_addr:10.1.1.20:3389 rdpclient/client.go:390
[2024-11-01T16:18:27Z INFO  tracing::span] connect_begin;
[2024-11-01T16:18:27Z INFO  ironrdp_async::connector] Begin connection procedure
[2024-11-01T16:18:27Z INFO  ironrdp_connector::connection] Server confirmed connection selected_protocol=SecurityProtocol(SSL) flags=ResponseFlags(EXTENDED_CLIENT_DATA_SUPPORTED | DYNVC_GFX_PROTOCOL_SUPPORTED | RDP_NEG_RSP_RESERVED | RESTRICTED_ADMIN_MODE_SUPPORTED | REDIRECTED_AUTHENTICATION_MODE_SUPPORTED)
[2024-11-01T16:18:27Z INFO  tracing::span] mark_as_upgraded;
[2024-11-01T16:18:27Z INFO  tracing::span] connect_finalize;
[2024-11-01T16:18:27Z INFO  ironrdp_connector::license_exchange] Server did not initiate license exchange
[2024-11-01T16:18:27Z INFO  ironrdp_async::connector] Connected with success
2024-11-01T17:18:28+01:00 INFO [WINDOWS_D] TDP input streaming finished pid:2023.1 client_ip:10.1.2.3 desktop_name:DC2-x-y-z-4c3e1114 desktop_addr:10.1.1.20:3389 teleport_user:user1 desktop_addr:10.1.1.20:3389 ad:true session_id:28135b38-9f97-45f0-bf91-f47765496f9c screen_size:0x0 computer_name:DC2 kdc_addr:10.1.1.10 nla:false rdp_addr:10.1.1.20:3389 rdpclient/client.go:403
2024-11-01T17:18:28+01:00 INFO [WINDOWS_D] RDP client exited gracefully pid:2023.1 client_ip:10.1.2.3 desktop_name:DC2-x-y-z-4c3e1114 desktop_addr:10.1.1.20:3389 teleport_user:user1 desktop_addr:10.1.1.20:3389 ad:true session_id:28135b38-9f97-45f0-bf91-f47765496f9c screen_size:0x0 computer_name:DC2 kdc_addr:10.1.1.10 nla:false rdp_addr:10.1.1.20:3389 rdpclient/client.go:374
2024-11-01T17:18:28+01:00 INFO [WINDOWS_D] Rust RDP loop finished pid:2023.1 client_ip:10.1.2.3 desktop_name:DC2-x-y-z-4c3e1114 desktop_addr:10.1.1.20:3389 teleport_user:user1 desktop_addr:10.1.1.20:3389 ad:true session_id:28135b38-9f97-45f0-bf91-f47765496f9c screen_size:0x0 computer_name:DC2 kdc_addr:10.1.1.10 nla:false rdp_addr:10.1.1.20:3389 rdpclient/client.go:377
2024-11-01T17:18:28+01:00 INFO [AUDIT]     windows.desktop.session.end cluster_name:teleport.x.y.z code:TDP01I desktop_addr:10.1.1.20:3389 teleport.dev/computer_name:DC2 teleport.dev/dns_host_name:DC2.x.y.z teleport.dev/is_domain_controller:true teleport.dev/origin:dynamic teleport.dev/os:Windows Server 2022 Datacenter teleport.dev/os_version:10.0 (20348) teleport.dev/ou:OU=Domain Controllers,DC=x-y-z,DC=eu teleport.dev/windows_domain:x.y.z desktop_name:DC2-x-y-z-4c3e1114 ei:12 event:windows.desktop.session.end login:user1 participants:[user1] private_key_policy:none recorded:true session_start:2024-11-01T16:18:27.603Z session_stop:2024-11-01T16:18:28.05148751Z sid:28135b38-9f97-45f0-bf91-f47765496f9c time:2024-11-01T16:18:28.051Z uid:b52a1acc-a6b1-4797-beca-0e4f8d885fe4 user:user1 user_kind:1 windows_desktop_service:252df4f8-6329-48e0-bce7-da1e0f8a7955 windows_domain:x.y.z windows_user:user1 events/emitter.go:288

[webvictim]

This usually happens when the configured RemoteFX settings aren't applying correctly.

Could you run this at an administrator command prompt and share the output please?

reg query "HKLM\Software\Policies\Microsoft\Windows NT\Terminal Services"

[Adevill20]

Hi @webvictim

here's the output:

HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Terminal Services
fEnableVirtualizedGraphics REG_DWORD 0x1
ColorDepth REG_DWORD 0x3
fDenyTSConnections REG_DWORD 0x0
UserAuthentication REG_DWORD 0x0
fPromptForPassword REG_DWORD 0x0
fNoRemoteDesktopWallpaper REG_DWORD 0x0

HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Terminal Services\Client

[webvictim]

What version of Windows are you running on this server? A screenshot of winver would be useful.

[Adevill20]

@webvictim some Windows Server 2022, some Win 10

[webvictim]

And this issue affects every single machine where you're installed the Teleport auth executable?

[Adevill20]

@webvictim Yes, all the windows machines I've tried