WIndows 11 remote desktop fail if ISE exist.

[Jero Cheng]

Hello

My company deployed ISE for LAN network for staffs desktop PC.

But I found that Windows 11 PCs are unable to connect RDP. If ISE applied on that network port.

The network switch port have the below setting:

If a target Windows 10 PC connected to this network port.Then I connect RDP to this target PC from another PC, its working fine.

Test scenario:

1: Windows RDP ,click connect to target PC

2:It looks good,Windows login screen is showed.

3: The screen freeze about 10s,I think the re-authentication is in progress.

4:Connected.

If a target Windows 11 PC connected to this network port.Then I connect RDP to this target PC from another PC,its failed.

Test scenario:

1: Windows RDP ,click connect to target PC

2:It looks good,Windows login screen is showed.

3: But after about 15s,it disconnected.

4:The target PC totally disconnected from network.I must re-login the target PC locally to get back on to the network.

All our PC have same GPO and NIC setting.

I found that the ISE take almost 40-50s to pass the authentication. But the RDP timeout within 15s.I think that's why the RDP disconnected.

If I remove the switch port setting show above.the RDP is working fine no matter Win10/11.

I totally disabled the Windows 11 "credential guard " as someone said it will break the 802.1x authentication.But didn't help.

Does anyone have an idea about this?

Thanks a lot,have a nice day.

[Dustin Anderson]

The big thing to take effect is to Windows, the RDP does not count as a login. You would need to see what ISE is showing for the port, but I would guess the ACL applied to the port may be blocking the RDP.

[Jero Cheng]

Thanks your information.

But the test I mention above are using same network port.it make me headache.

[Greg Gibbs · Accepted solution]

See a similar discussion here. The Windows native supplicant will not provide this functionality, so you would need to use the Cisco Security Client (AnyConnect) Network Access Manager (NAM) module as the supplicant to support this RDP use case.