NLA Error 0x0002000F (STATUS_PASSWORD_EXPIRED) on Android client when RestrictReceivingNTLMTraffic = 2 (Workgroup)

NLA Error 0x0002000F (STATUS_PASSWORD_EXPIRED) on Android client when RestrictReceivingNTLMTraffic = 2 (Workgroup)

avatar
pmmxxx

Hello Devolutions Support
I would like to report an issue/feature request regarding the Remote Desktop Manager mobile app (Android) when connecting to a standalone Windows Server (Workgroup environment, no Active Directory domain) over RDP with NLA enabled.
Issue Description: When the target server has the registry key HKLM\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0\RestrictReceivingNTLMTraffic set to 2 (Deny all NTLM incoming traffic), the RDM Android app fails to establish an RDP connection and throws the error: Не удается подключиться к узлу ... Срок действия пароля истёк. (0x0002000F) / STATUS_PASSWORD_EXPIRED.
Root Cause Analysis:

  1. In a Workgroup environment without Kerberos/KDC, the Android RDM client relies on NTLMv2 for CredSSP/NLA authentication.
  2. When RestrictReceivingNTLMTraffic = 2 is set on the server, LSA immediately drops the raw NTLM handshake (STATUS_NTLM_BLOCKED / 0xc0000388).
  3. The mobile client misinterprets this response as STATUS_PASSWORD_EXPIRED (0x0002000F).
  4. In contrast, the new Windows App (mobile) and native desktop client manage to properly wrap authentication inside a TLS/CredSSP context without triggering this NTLM block error.

Requested Fix / Feature Request:

  1. Improve error handling in the mobile app so that 0x0002000F isn't incorrectly shown when NTLM is explicitly rejected by the LSA policy.
  2. Update the FreeRDP/CredSSP implementation in the RDM mobile app to support TLS-wrapped authentication contexts (similar to Microsoft Windows App) so that connections in Workgroups can succeed without forcing servers to accept plain incoming NTLM traffic.

Thank you!

All Comments (1)

avatar
Alexis Geller Peiro

Hello,

Thank you for the detailed report and for the root cause analysis, it is very helpful.

We have not been able to confirm yet that the server is returning STATUS_NTLM_BLOCKED and that the app is translating it into "password expired" (0x0002000F). To check that and to understand why the connection fails, we need a few details:

1. The exact RDM Android version and the Windows Server version of the target machine.
2. Whether you sign in with a local account or with a Microsoft account.
3. The RDP log from the Android app. To get it, go to the application settings (not the entry), Sessions, RDP, and enable logging. Then reproduce the issue and open Tools, Private Storage Explorer, Logs folder. You can share the file from there.
4. The result of these tests on the entry, one at a time:
  a. Untick NLA in the entry, if your server allows connections without NLA.
  b. In the Authentication tab, set the Authentication Package to NTLM.
  c. In the Authentication tab, set the SSPI Module to System, then to Portable.

Please keep in mind that in a workgroup there is no Kerberos, so NLA can only authenticate with NTLM. With RestrictReceivingNTLMTraffic set to 2, the server rejects that exchange, so we need to confirm how the Windows App behaves in your environment (for example, whether it connects without NLA) before we can say whether anything can be done on the RDM side.

Once we have this information, we will review it and come back to you.

Best regards,

Alexis Geller Peiro