Logoff on a RDP machine finishes 802.1x session/Default VLAN

[network_geek1979]

Team, an issue we are facing with one of our client machines.

We have some end user who try an RDP to a machine in the office network.
However, in our case for a successful authentication to take place the machine must show the user certificate to the network.

Till the user does an RDP certificate authentication does not work, and the machine gets an IP address on the Guest VLAN till then.
Any suggestions on getting over this behavior?

Regards,

N!

[Dustin Anderson]

Not a helpful answer, but the issue is Microsoft doesn't register an RDP session as a login, so the networks will still see it as a machine. I don't know of a way around it without some installed program to force it.

Here we have Citrix and a receiver app installed on computers so when they remote in it triggers it as a login.

[ahollifield · Accepted solution]

AnyConnect NAM solves this problem.

[Dustin Anderson]

AnyConnect NAM causes more problems than it solves lol.

[Aref Alsouqi · Accepted solution]

As already mentioned, you would need to install AnyConnect NAM or you can also use TEAP to fix that issue. Essentially what you need in this case is EAP chaining, otherwise when the user tries to RDP to the remote host, the session will still be previous one that has been already authenticated and authorized. AnyConnect NAM require buying its licenses as well as deploying the software on all the hosts that would be RDP'ed. However, TEAP is much simpler and has no extra cost, the only thing to keep in mind with TEAP is that you need the Windows 10 build 2004, otherwise you won't see it as an option in the NIC dot1x tab.