2008 Terminal Server – Single Sign-On
27 maart 2009
It is possible to provide Single Sign-On for the client PC’s in a 2008 Terminal server environment. With this feature, you can use the credentials of the currently logged on user (also called default credentials) to log on to a remote computer (Terminal Server).
The condition is that you use a client with Windows XP SP3 or Windows Vista.
How to do?
1. Open Group Policy Management and enable the ”Allow deligating Default Credentials” setting. Add the Terminal Server to the list with TERMSRV\tsname or use TERMSRV\* for all Terminal Servers.
2. When you use Windows XP SP3, you have to do some extra settings in registry (check KB951608) to enable CREDSSP:
- Click Start, click Run, type regedit, and then press ENTER.
- In the navigation pane, locate and then click the following registry subkey:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
- In the details pane, right-click Security Packages, and then click Modify.
- In the Value data box, type tspkg. Leave any data that is specific to other SSPs, and then click OK.
- In the navigation pane, locate and then click the following registry subkey:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders
- In the details pane, right-click SecurityProviders, and then click Modify.
- In the Value data box, type credssp.dll. Leave any data that is specific to other SSPs, and then click OK.
- Exit Registry Editor.
- Restart the computer.
For more info: check Terminal Server Team Blog