RDP login on 802.1x using MAR

[gpinero]

I'm facing the issue that when user try to login using RDP in a machine that is authenticated using MAR the  user event is not send. If machine and user are in different vlan's or has ACL applied the RDP session not works.

Anyone has this issue? How do you solve it?

I'm using native Windows 7 supplicant, if computer and user are in the same vlan this works. But the user is not authenticated. The switch only see the computer authentication event.

If the user login in normal way (not using RDP) the user auth is applied successfully but using RDP user login is not send by te supplicant.

I will try with anyconnect...

Thanks

[Mohammed al Baqari · Accepted solution]

Windows will not trigger an 802.1x authentication for an RDP session even
though the authentication mode (wired or wireless) is configured for “User
or computer authentication”. It’s even documented for Windows 7:

802.1x user authentication fails when a RDS connection comes in
<>

“When 802.1x authentication mode is configured to user authentication, the
supplicant fails to query the user token in the remote desktop session.”

Deploy Cisco AnyConnect with the NAM module.
**** remember to rate useful posts

[Marvin Rhoads]

Good tip @Mohammed al Baqari.

I found this to be the case even with the later versions of Windows.

https://docs.microsoft.com/en-us/troubleshoot/windows-client/remote/cannot-use-802dot1x-user-authentication-connect-rds

[Cisco-User500]

I am seeing the same issue with Windows 10 and TEAP. If I log in locally, both machine and user authentication are sent, However, If I do RDP, only machine authentication is being processed. The PC does not authenticate the user. short of deploying NAM, is there a work around for this?

[Marvin Rhoads]

As noted by @Mohammed al Baqari back in 2019 and more recently in my 01-22-2022 post, Windows does not send the User Authentication via 802.1x when logging in via Remote Desktop Services.

I don't know of any work around.