Allow SingleSignOn with Windows 7 x64

[MichaelfromAFI]

Hi all

We use VMWare View Client to access VM. We activated in a GPO (VMware View Agent Configuration) the setting "Allow SingleSignOn"

We use as Desktop-OS Windows XP SP3 and Windiws 7 x64

The SingleSignOn works with Windows XP, but not with Windows 7 x64.

In the GPRESULT it states, that the setting Allow SingleSignOn is activated-

vSphere 4.0.1

View Manager 4.5

ESX 4 U1 server

Anyone an idea?

thx

[grossag]

When you say that it doesn't work on Win7 x64, can you be more specific? Are you seeing an error message or does it look like single sign-on is not even being attempted?

[MichaelfromAFI]

I mean the SingleSignOn doesn't work, so I have to authentificate against the Windows 7 once again.

So that means I have to Logon with the View Client and once I select the Pool I have to Logon to the Windows 7 again with Username and Password.

thx

[grossag]

Yes I understand what you mean by it not working, but I still need you to be more specific. When you connect to the remote desktop, what is the first screen that you see before you hit any keys? Does it say "Press CtrlAltDel", does it show you an error message, or does it show you a bunch of tiles?

[MichaelfromAFI]

Ah . . . sorry

I see the Login Screen of Windows 7, where I can enter Username and Password. I don't see the "Press CtrlAltDel". That seems to be already done.

[grossag]

Ok thanks. Just to clarify, do you see a bunch of tiles then you have to click a specific tile to enter your username/password? Or is the first screen you see asking you for your username/password without any clicks needed to get there?

[MichaelfromAFI]

The first screen I see is asking for username/password without any clicks. See the Printscreen

thx

[grossag]

Ok thanks. Can you try the following:

1) Which protocol are you using? Can you try with another protocol to see if single sign-on succeeds?

2) Search the Agent VM's registry for the "AllowSingleSignOn" value? Is it accidentally set to "false" anywhere in the registry?

FWIW, AllowSingleSignOn's default value is "true" so there really isn't any need to explicitly activate it.

[MichaelfromAFI]

Thanks for your reply

1) We are using PCoIP --> do not work

I tried it with RDP and there is the SingleSing-On working.

2) I searched the whole Registry and all "AllowSingleSignOn" values are "true"

So it seems to be an PCoIP issue?

Thanks

[grossag]

Can you send me the most recent agent log over e-mail (my e-mail address is my forum username @ vmware.com). Enable TRACE logging in the remote desktop by creating a REG_SZ "HKLM\Software\VMware, Inc.\VMware VDM\TraceEnabled" and set it to "true". Then reproduce the issue and find the most recently modified log file starting with "debug" at: C:\Users\All Users\VMware\VDM\Logs.

[grossag]

I have another idea. Do you have the "Disable CtrlAltDel requirement for logon" GPO set (info here: http://msdn.microsoft.com/en-us/library/ms814164.aspx )? Looking at the log you sent me, it was sort of implied that this GPO was set. If CtrlAltDel is not required, then PCoIP SSO will fail. For now, PCoIP SSO depends on the ability the simulate CtrlAltDel immediately after a connection is made and we have the credentials.

[MichaelfromAFI]

Sorry for the delay.

Yes we use GPO and have the setting "Disable CtrlAltDel requirement for logon". I changed this to unconfigured. Then I rebooted all the VM's.

I even tried it a cpuble of times. But it's still the same behavior.

thanks

[grossag · Accepted solution]

Did you verify that the "Do not require CtrlAltDel" behavior is not taking effect? It should be easy to verify when you boot up the VM. If you verified that this behavior isn't taking effect but the SSO is still failing, e-mail me another TRACE log from the agent and I'll take a look.

[MichaelfromAFI]

I tried it once again and this time I set the GPO with the option "Do not require Ctrl+Alt+Del" to disabled instead of not configured and now it works 🙂

Thank you very much for your help.