Remote Desktop (mstsc) over PKU2U: client and server prerequisites

• Microsoft Entra authentication: the Use a web account to sign in to the remote computer option, or the RDP property enablerdsaadauth:i:1. The client gets a token from Entra ID and the remote PC validates it. PKU2U is not involved. The client needs no join of any kind, but it must be online, the name typed must be the device name known to Entra ID, and an IP address is not accepted.
• Classic NLA, the default: CredSSP runs over TLS, and inside it SPNEGO. Between two Entra devices neither Kerberos nor NTLM can work, so Negotiate goes through NegoEx, and NegoEx picks PKU2U. This page covers that case.

With NLA, the steps are those of any CredSSP connection. First the TLS channel. Then SPNEGO / NegoEx / PKU2U, six tokens with three round trips. Then the TLS public key and the delegated credentials, encrypted with the PKU2U context (SpSealMessage / SpUnsealMessage). Then the session logon on the server with the delegated credentials.

Sources: Microsoft Learn, Connect to remote Microsoft Entra joined device, and the Windows 365 / Azure Virtual Desktop troubleshooting pages (“The logon attempt failed” = PKU2U refused on one of the two ends).

• Both ends need a certificate from the same identity provider. PKU2U is PKINIT with no KDC: the client signs an AS-REQ, the server signs the AS-REP. Every certificate has to map to an identity provider of certpoleng.dll, meaning its issuer has to be in the provider's trust store. For Entra the provider is AzureAD, its store is AAD Token Issuer, and the certificates are the device and user peer-to-peer certificates Entra issues. That is why both machines must belong to the same tenant.
• The server's certificate is chosen by the name you type in mstsc. The acceptor runs as a machine identity, and certpoleng selects its certificate from the host part of the target (TERMSRV/<name> → <name>). A name the device's certificate does not carry gives no certificate, hence SEC_E_NO_CREDENTIALS.
• The remote user becomes a Windows token through the identity provider: an Entra user for the AzureAD provider, a local account named after the certificate for the local provider (see below). Without a matching account, the cryptographic exchange succeeds and the last step fails with SEC_E_LOGON_DENIED.
• AllowOnlineID is read on the accepting side, before a certificate is selected, for online identities.

Two Windows 11 machines in a workgroup, PKU2U-SRV and PKU2U-CLIENT. The scripts Pku2uServer.ps1 and Pku2uClient.ps1 are in Pku2uLab.zip and listed in full in PKU2U internals. They use the built-in local identity provider {6D0F37E4-4FAC-4E44-9C07-6B8343FE4953}.

Prerequisites

Server: elevated window

.\Pku2uServer.ps1 -Step Ca -ServerName PKU2U-SRV -UserName User
.\Pku2uServer.ps1 -Step Machine
.\Pku2uServer.ps1 -Step Rdp
Restart-Computer

• Ca: the lab CA, the certificate CN=PKU2U-SRV in LocalMachine\My, and the certificate of the account User in pku2u-lab\user.pfx.
• Machine: the CA in LocalMachine\Local Cert Issuer, the local provider enabled.
• Rdp: Remote Desktop on, with Network Level Authentication, and its firewall rules.

Client: elevated window, then a normal one

Copy the server's pku2u-lab folder next to the script. Elevated:

.\Pku2uClient.ps1 -Step Machine
.\Pku2uClient.ps1 -Step Rdp -ServerName PKU2U-SRV -ServerAddress 192.168.45.214
Restart-Computer

Then in a normal PowerShell window, as User:

.\Pku2uClient.ps1 -Step User  -ServerName PKU2U-SRV
.\Pku2uClient.ps1 -Step Mstsc -ServerName PKU2U-SRV

• Rdp: the Allow delegating default credentials policy and its …with NTLM-only server authentication variant for TERMSRV/*, so that mstsc connects with the session's own credentials instead of asking for some. -ServerAddress adds the server to hosts.
• User: the certificate of User in CurrentUser\My, saved in Credential Manager under the host name PKU2U-SRV (a Domain Certificate in cmdkey /list), and any credential saved for TERMSRV/PKU2U-SRV removed.
• Mstsc: one throwaway PKU2U attempt, then mstsc /v:PKU2U-SRV. After a restart, the first mapping of a client certificate fails while certpoleng loads its providers; without that attempt, the first connection after a boot fails with 0x80004005 and the second one works.

Result

mstsc connects without any prompt. PKU2U authenticates both machines with their certificates: the client presents CN=User, the server CN=PKU2U-SRV. Then CredSSP sends the client session's credentials (the password of User), and the server opens the desktop session. mstsc shows no warning about the server's RDP certificate either, because the PKU2U exchange has already authenticated the server. With a smart card instead of the saved software certificate, the same pair stops at the first step with The logon attempt failed (see the table above).