soltech

Is there a way to batch edit the "password only available to administrator" check box?

Thanks

that seems to have worked in our instance. I dont understand why n all the other threads in the Mac forum people were told to turn off NLA, but here we want it on.

We are using the default remote desktop template as pictured. I have even created new connections changing only the name, IP, and unchecking the NLA box. That did not help

NLA is already turned off on the sessions. It is also not required on the Server 2012 R2 devices we are connecting to. I am sorry I forgot to mention that. And yes I do mean quick connect. If I hit the quick connect button, enter the IP of the server (or the host name), enter the username, and enter the password it will connect fine. I just cannot get any existing RDP sessions to connect. The same RDP sessions work fine on Windows machines.

Please bare with me as I am not a Mac guy. We have been using RDM for 4 years now in the Windows world, but we recently added a new MacBook Pro to the mix. We are having issues connecting to our sessions. #1 when we launch an RDP session it gives the 131084 error. We are running OS X El Capitan (10.11.3) and RDM Enterprise 3.0.8.0. We connect to our customer sites through L2TP VPNs and the only way I can seem to get an RDP session to open is with quick launch. Here are the logs from a failed session launch:

[09:30:54:249] [1719:b029b000] [INFO][com.freerdp.client.mac] -[MRDPIPCClient initLoggingWithFilter:filePath:fileName:] 117 - Log initialized headless

[09:30:54:250] [1719:b029b000] [DEBUG][com.freerdp.client.mac] -[MRDPIPCClient configureInternal] 90 - configureInternal

[09:30:54:270] [1719:b039f000] [DEBUG][com.freerdp.channels.cliprdr.client] cliprdr_VirtualChannelEntry 1362 - VirtualChannelEntry

[09:30:54:270] [1719:b039f000] [INFO][com.freerdp.client.common.cmdline] freerdp_client_load_static_channel_addin 2335 - loading channel cliprdr

[09:30:54:270] [1719:b039f000] [DEBUG][com.freerdp.core.nego] nego_set_negotiation_enabled 1186 - Enabling security layer negotiation: TRUE

[09:30:54:270] [1719:b039f000] [DEBUG][com.freerdp.core.nego] nego_set_restricted_admin_mode_required 1198 - Enabling restricted admin mode: FALSE

[09:30:54:270] [1719:b039f000] [DEBUG][com.freerdp.core.nego] nego_enable_rdp 1220 - Enabling RDP security: TRUE

[09:30:54:270] [1719:b039f000] [DEBUG][com.freerdp.core.nego] nego_enable_tls 1232 - Enabling TLS security: TRUE

[09:30:54:270] [1719:b039f000] [DEBUG][com.freerdp.core.nego] nego_enable_nla 1244 - Enabling NLA security: FALSE

[09:30:54:270] [1719:b039f000] [DEBUG][com.freerdp.core.nego] nego_enable_ext 1256 - Enabling NLA extended security: FALSE

[09:30:54:270] [1719:b039f000] [DEBUG][com.freerdp.core.nego] nego_connect 148 - state: NEGO_STATE_TLS

[09:30:54:270] [1719:b039f000] [DEBUG][com.freerdp.core.nego] nego_attempt_tls 459 - Attempting TLS security

[09:31:09:271] [1719:b039f000] [ERROR][com.freerdp.core] freerdp_tcp_connect 1140 - failed to connect to 10.34.0.2

[09:31:09:271] [1719:b039f000] [ERROR][com.freerdp.core.nego] nego_connect 154 - Protocol Security Negotiation Failure

[09:31:09:271] [1719:b039f000] [ERROR][com.freerdp.core] freerdp_set_last_error 680 - freerdp_set_last_error ERRCONNECT_SECURITY_NEGO_CONNECT_FAILED [0x2000C]

[09:31:09:271] [1719:b039f000] [ERROR][com.freerdp.core.connection] rdp_client_connect 275 - Error: protocol security negotiation or connection failure

[09:31:09:272] [1719:b039f000] [DEBUG][com.freerdp.client.mac] -[MRDPIPCClient viewDidConnect:] 401 - viewDidConnect

[09:31:09:782] [1719:a3e69000] [DEBUG][com.freerdp.client.mac] __39-[MRDPClient invalidatePasteboardTimer]_block_invoke 132 - timer stop

If you go to File > Options and then to the Trayicon/Taskbar tab you will see some options at the top. There is a drop down for Show trayicon and show in taskbar... there is also a check box right below that for reduce to trayicon/taskbar on close. I have show trayicon set to always visible, show in taskbar set to never visible, and reduce to trayicon/taskbar on close is checked. If I minimize or close it goes to tray... it never goes to task bar.

gotcha... I see now what you are asking for. I could see where that could be handy. In order for that to work it would have to be able to tell if there is a corrisponding VPN that needs to be connected and if that VPN is connected before scanning devices for up/down status.

I think this would be a great feature and I would not mind if the "shortcut" used the same security group settings as the source session.

I would like to request for a status icon that shows if a connections is up or down.

Example: If I created an rdp session, i would like a quick glance to know if it is online or offline. (green or red).

I could be miss-understanding what you are asking for, but I am pretty sure RDM already does this. My session icons change to a green arrow when they are connected. See the attached pic

Here is a screen shot of what the structure looks like before searching, what it looks like after searching (sort priority out of wack, custom icons gone), and a third of the missing text in the data entry tabs.

Another couple bugs in the beta... #1 when you run a search it expands all the folders it finds something in and they stay expanded after you clear the search... so if each of our sites has a domain controler and that is what I search for then I ended up with this giant list of expanded sites... #2 if you do a search than all your custom icons disapear until you clear the search... #3 If you run a search the results completely disregard the sorting priority you have set up on the advanced tabs of sessions... #4 If you view a data entry, the lower set of tabs are blank. So for instance, if you have an entry with Account and Serial checked, when you view it you should see two tabs that say Account and Serial... instead the two tabs are blank.

@Soltech,

I completely understand your use case and for this scenario, you should configure a Web browser session and not a data entry. Have you tried?

Not sure what you want me to do with that... I am talking about all kinds of sessions, especially RDP's where I want the staff to log on using certain credentials, but I do not want them to know what those credentials are.

@soltech

Allow reveal password from the user setting is not used only for a data entry because it does not make sense to give access to somebody without giving them the password. It's not possible to use it for anything if you can copy it in the clipboard. Maybe I missed a case.

Alright, here is my use case. I want the "Password only available to administrator" check box to be only editable by administrators. Anybody who can create sessions/entries should be able to check the box, but once the session/entry is created only administrators should be able to turn it off. I also do not want any non administrator employee to be able to copy the password to the clip board. The employee should be able to utilize the credentials in embedded situations, but they should not be able to retrieve the password. The purpose is so that if an employee leaves the company, they are not leaving with a bunch of passwords.

It appears the security is fixed so that people that are not administrators can not reveal passwords if the box is checked.... but if they have rights to edit the data entry they can uncheck the box, go back into it, and view the password. So thinking about this I am not sure what the best answer is. I have some domain administrative accounts that I want our help desk to be able to utilize (i.e. auto log on to RDP sessions with), but I do not want them to be able to change the password and I especially do not want them to be able to view the password. Is this possible currently?

It would seem to me that the "Allow reveal password" box in the User management should control this, but it does not seem to do much of anything.

edited by soltech on 2/6/2012

the sorting for me is backwards from what the text says... the text says the higher the number you enter, the higher up the folder will appear. so 99 should be above 98... that is not the case... if you set the item you want at the top up with a sorting priority of 1 then it will be the top item

Hi,

Thank You! It's working.. Is there a way to have it sign out when you close the tab?

Where do you find the correct values at?

Hi,

I will see what I can do for the signout but for now I don't see any solution.

What Cody wants is to be able to create links to the Office 365 administrative page and have several customer's open at one time. Here is a URL that talks a bit about the possibilities... if you launched iexplore.exe with the -nomerge option it works.

http://blogs.msdn.com/b/ie/archive/2009/05/06/session-cookies-sessionstorage-and-ie8.aspx

edited by soltech on 2/2/2012

David, is there a way to implement this in RDM... by that I mean the -nomerge option for IE? If you do a command line session you can launch, but you do not get the autofill feature like you do with a web session.

Hi,

Thank You! It's working.. Is there a way to have it sign out when you close the tab?

Where do you find the correct values at?

Hi,

I will see what I can do for the signout but for now I don't see any solution.

What Cody wants is to be able to create links to the Office 365 administrative page and have several customer's open at one time. Here is a URL that talks a bit about the possibilities... if you launched iexplore.exe with the -nomerge option it works.

http://blogs.msdn.com/b/ie/archive/2009/05/06/session-cookies-sessionstorage-and-ie8.aspx

edited by soltech on 2/2/2012

Hi,

Yes it's the binaries were fixed but could you give me more details about your empty folder? Is it possible that they are related to a credential or something like that?

Here is a screen shot of the two versions of 6.9.6.0 and how they appear different... all the extra folders that you see cannot be manipulated in any way.

Hi,

I have updated the binaries this version with a fixed version. All the files have been overwritten.

edited by dhervieux on 1/27/2012

Does this mean we re-download the 6.9.6.0 version and you have fixed the permissions issue?

Well I brashly re-downloaded 6.9.6.0 and installed it. It revieled a bunch of empty folders off the root of "Sessions". I could not delete them or move them. I uninstalled and re-installed from my older download of 6.9.6.0 and everything went back to normal. Of course the permissions thing is still there where any user can show passwords even if they are marked only for administrators to view.

edited by soltech on 1/31/2012

Hi,

I have updated the binaries this version with a fixed version. All the files have been overwritten.

edited by dhervieux on 1/27/2012

Does this mean we re-download the 6.9.6.0 version and you have fixed the permissions issue?

Hi,

In the entry, do you have the checkbox "Password only available to administrator" checked? Are they administrator too?

David, the checkbox is checked and the users are not administrators. They also were not added previously to the SQL server so they only have the rights created by RDM when added as a user. I questioned this a bit though because they were added as dbo's to the RDM database. I lowered that to guest and that had no effect. They still seemed to be able to do what ever the wanted in RDM.

I have a major problem going on with 6.9.6.0. All users are able to reveal passwords when they view the credential entries. They do not have the box checked that says "allow reveal passwords".

The problem is also gone for me. Thanks to David and the Devolutions development team.

I am unable to drag the desktop icons either.

You can add me to the list of people that cannot drag or resize windows... I am running Windows 7 64bit... I tried just running MSTSC and it works fine, but inside RDM beta 6.9.4.0 I cannot resize or move windows. I will try uninstalling fully with the next beta release. Also I am not using large fonts.

edited by soltech on 1/17/2012