Discussion between Pimp Juice IT and saastn

saastn

04:03

sorry for being late, time difference! this is ipconfig results, which is same to what I set in adapters' properties. pc1, wired: 169.254.128.110; pc1, wireless: 192.168.1.100; pc2, wired: 169.254.128.112; pc2, wireless: 192.168.1.102. All subnet masks: 255.255.255.0

@PimpJuiceIT sorry for being late, time difference! this is ipconfig results, which is same to what I set in adapters' properties. pc1, wired: 169.254.128.110; pc1, wireless: 192.168.1.100; pc2, wired: 169.254.128.112; pc2, wireless: 192.168.1.102. All subnet masks: 255.255.255.0

Trouble Maker Chat Broom

05:20

@saastn It sounds like the the Ethernet connected ports are not able to get an IP address via DHCP even though they are configured to get an IP address that way. Configure one to use 192.168.2.10 and the other to be 192.168.2.11 and both with a subnet mask of 255.255.255.0 without any default gateway too.

Just assign those IP addresses to the two Ethernet NICs from the two machines and then with the Ethernet cable connecting them however you are connecting physically, now try to access the other based on it's new 192.168.2.X address.

Are these two machines wired to a router or are you wiring them from one NIC to the other NIC or what?

saastn

@TroubleMakerChatBroom Done, now they ping each other with new ips, but no connection via RDC, same behavior.

@TroubleMakerChatBroom They are directly connected to each other.

Trouble Maker Chat Broom

13:49

@saastn Okay, so with that setup that ping is successful, try to run this command from an elevated as administrator command prompt, and then test again afterwards and see if it allows the connection . . . netsh advfirewall set allprofiles state off

That will essentially disable the Windows FW from being active and will help determine if the Windows FW is blocking the connection.

If it is and that is confirmed to be the case, you want to re-enable the FW rules to become effective again by running . . . netsh advfirewall set allprofiles state on

Now to resolve assuming that's the issue is to stay in the Administrator Elevated command prompt and create a new FW rule that allows the IP range for the LAN connection to be allowed for RDC access. . .

The command to run is perhaps

netsh advfirewall firewall add rule name="__Allow Inbound RDP" dir=in action=allow protocol=TCP localport=3389 remoteip=192.168.2.0/24 enable=yes profile=domain,private,public

but name accordingly to whatever you wish.

If after running that command with the FW rules back re-enabled works, then that is the issue.

Tag me back if so and I'll be glad to add an answer under my PimpJuiceIT handle name; I'm not sure why sometimes my Broom handle shows on chat sessions and other times my SU PimpJuiceIT handle name. Let me know how it goes regardless but this is my thought since you confirmed you can connect to RDC via the wi-fi just not the LAN.

@saastn Read above just in case wanted to tag you one more time

saastn

@TroubleMakerChatBroom God bless you! It was windows firewall!

but how? these two both connect a third computer and vice versa!

They also connect each other when connected to wireless network..

Trouble Maker Chat Broom

14:17

@saastn Give me a few minutes and I will add an answer. Can you confirm if the

netsh advfirewall firewall add rule name="__Allow Inbound RDP" dir=in action=allow protocol=TCP localport=3389 remoteip=192.168.2.0/24 enable=yes profile=domain,private,public

command resolved it or not with it enabled??

If so, I will explain in my answer why this is the case per the way the Windows FW restricts or allows, etc.

I'm curious to know if it was simply disabling that fixed it or if that rule resolved or if you customized the FW rule? @saastn

saastn

wait, I'm testing something. I havn't yet added the rule to allow..

Trouble Maker Chat Broom

No worries, I don't want to add an answer unless we confirm it works but I will explain with more detail there. I see the other answer regarding the FW but it is vague with no detail; I will add a good answer with more detail explaining if that resolves. I do want to be sure to add the proper FW rule syntax that you confirm resolve if that is the case. Take your time!!

saastn

Look, when I disable fw at both ends, one connects but the other can not start RDC as source. It shows the 3-reason-page but does not wait as much as it does when FW is enabled. Any idea?

Trouble Maker Chat Broom

So when both are disabled one does not allow RDP connection but the other does but there is a lag? When both are enabled with FW rules to explicitly allow that does not have a lag and connects from both ends? That would seem backwards so help me understand better if you can.

@saastn Here's another command to add RDC rules to allow that opens it up wide that you can run elevated on both ends and then test....

netsh advfirewall firewall add rule name="__RDP Inbound Allow" dir=in action=allow remoteip=any localip=any protocol=TCP localport=3389 remoteport=3389 profile=any

saastn

14:32

No, excuse my poor English. Let's call them 1 and 2, now FWs are disabled on both of them. I can connect from 1 (if I get it right it means that 2 allows RDC, right?). but I can not connect from 2. But when trying to connect from 2, it displays the message after 1-2 seconds, however when FWs were enable it took about 15 secs to show it.

Something else, I can connect from 1 when 2's FW is disabled even if 1's FW is enabled.

Trouble Maker Chat Broom

14:55

@saastn Have you tried from admin elevated command prompt on both machines with the FW enabled this command:

netsh advfirewall firewall add rule name="__RDP Inbound Allow" dir=in action=allow remoteip=any localip=any protocol=TCP localport=3389 remoteport=3389 profile=any

and then test and see if those allow access?

Furthermore, consider testing with the Wi-Fi adapters disabled entirely too if you can. Just be sure the LAN adapters are the only ones enabled. To start, I'd start there to troubleshoot and find the rules that are required to make that work. Then I'd enable the Wi-Fi adapters to and test however you typically have that setup upon RDC connection.

Meaning on both machines.... Wi-Fi NICs disabled, FW enabled, test with the rules to allow any inbound port 3389 all network scopes, profile zones, etc. @saastn

saastn

Added the rule on both sides, disabled both WiFis, enabled FW on both, no connecthen from neither of them. When FW is disabled on 2, I can connect from 1. No success from 2 yet.

Trouble Maker Chat Broom

15:22

So are you direct connected from machine LAN/Ethernet port to the other machine's LAN/Ethernet port with a Cross-Over cable or is there a router or switch those are connected to Ethernet cable wise? Help me understand the type of cable and the way those are physically connected via Ethernet?

So is it wide open from one to the other in both directions when both Wi-Fi disabled and both FW disabled?

saastn

@TroubleMakerChatBroom They are directly connected using a crossover cat5. No router or hub.

@TroubleMakerChatBroom I'm not sure about both directions! I start RDC on one and connect to the other with success, but when I try to start RDC on the other and try to connect the first one it fails. Both WiFis and both FWs are disabled.

Trouble Maker Chat Broom

So tell me again what in particular you want to accomplish just to ensure I understand... You only need to connect to 1 from 2 via RDC only or from 2 to 1 or both? @saastn

saastn

both

:) I just read that again and first 2 options were same, did you mean that?

Trouble Maker Chat Broom

It was probably a typo that I edited, etc.

LOL.... no that's not what I meant.... from 1 to 2 or from 2 to 1 is what I meant

saastn

OK, then both again!

Trouble Maker Chat Broom

16:19

Are you able to get a successful ping response on both with the wifi and FW on both disable?

saastn

Yes.

Trouble Maker Chat Broom

16:59

What's the error you see with the RDP connection that does not work when those things are disabled and it fails?

saastn

---------------------------
Remote Desktop Connection
---------------------------
Remote Desktop can’t connect to the remote computer for one of these reasons:

1) Remote access to the server is not enabled
2) The remote computer is turned off
3) The remote computer is not available on the network

Make sure the remote computer is turned on and connected to the network, and that remote access is enabled.
---------------------------
OK Help
---------------------------

Trouble Maker Chat Broom

17:15

@saastn

@saastn From admin elevated command prompt, run reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f on the machine which does not allow RDC access. What happens once that is set and then you try again with the WiFi and FWs disabled?

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f

saastn

17:34

One step forward! After adding the key, With Wifis and FWs disabled, when I hit then connect button it asked it showed the authentication window, displayed the right user for destination machine and asked for password, which I left blank.

then it accepted and started to connect, the smaller window with the progressbar that usually says "initiating remote connection ..." displays and changes its message multiple times so fast that I can't read, and then hides with no error or anything, but remote desktop window wont appear.

I tried to catch the progress window using Print Screen, what I get is "Configuring Remote session ..." step.

Trouble Maker Chat Broom

@saastn Restart both machine and try again with those disabled just in case. Or maybe just try to restart the machine that keeps giving trouble connecting just in case. I hate overlooking something simple so there's nothing to lose. I'd restart it and then disable the FW and WIFI again and see if that changes anything.

Also from the RDP icon you use to connect, right click it and select editand from the Advanced tab set the option "if server authentication fails" to Connect and don't warn me and test with that value. Test with the other values as well.

From the Experience tab of the RDP icon edit properties, set the speed to LAN (10 mbps ...) and test with those settings as well. When/if you find settings that work here, be sure to go back to the General tab and select Save... @saastn

saastn

19:36

I really appreciate your help. Restarting and Speed Option didn't change anything. But "if server authentication fails" did, it was "Warn me" by default that I described before. "connect and don't warn me" has same behavior, but when select "Do not connect" it displays an error message.

first when I give remote computer's IP address:

But if I enter remote computer's name, then it always ask for username and password, and no matter if I give right authentication or just garbage:

@TroubleMakerChatBroom an this is what I get when I hit "View certificate ...":

saastn

20:06

When I try to connect form the other computer (the one that connects), if I select "Do not connect", no matter if I enter IP address or computer name, it always displays second error message (certificate is not from trusted ...).

Trouble Maker Chat Broom

21:06

You can run

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v SecurityLayer /t REG_DWORD /d 0 /f

on the machine that does not allow the connection and then see if it allows you to connect without that error? I'm not sure if a restart is required or not so try before a restart and if not, restart and then try again.

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v SecurityLayer /t REG_DWORD /d 0 /f

And I'm keeping track of everything as we make progress so if it does help fully resolve your problem, I'll write a nice clean answer with explanation and detail regarding the matter to ensure it's a useful post to others looking for a solution to this in the future.

@saastn ^ ^

Transcript for

Discussion between Pimp Juice IT and …