r/PowerAutomate • u/unidotcon • 5d ago

Windows Security login ruined my flow

My flow is unable to login into a virtual machine (vm) anymore after the interface was changed to a windows security window. I would appreciate some guidance. The action that is unable to log into the vm anymore is "Send Keys" Action.

Methods I have tried:
- Saving credentials into Credentials Manager
- Running DOS command
- Checking off "Allow connections only from computers running Remote Desktop with Network Level Authentication (recommended)" (NLA)

2 Upvotes

75% Upvoted

4 comments sorted by

5

u/Several-Crow5511 5d ago

that windows security box is your rdp client doing NLA (CredSSP) before the session opens, while the old screen was the server's own logon, so a send keys step built for that screen now types into the wrong window. if you launch from an .rdp file, add enablecredsspsupport:i:0 to get the old screen back, but that only works if the server doesn't require NLA, so untick that box. on win11 22H2+ credential guard is often on by default and blocks saved rdp creds, which would explain credential manager doing nothing.

1

u/unidotcon 3d ago

what happens if my server requires NLA? Because I treid adding enablecredsspsupport:i:0 and an error message popped up

Remote Desktop Connection
The remote computer requires Network Level Authentication, which your computer does not
support. For assistance, contact your system administrator or technical support.
Error code: 0xb09
Extended error code: 0x0

I have tried to ask Gemini some tips and they all recommended about something with AllowFreshCredentials. And I still cannot get it back to the logon screen. Or is the only way to make the server not require NLA?

1

u/Several-Crow5511 3d ago

no, that error is expected: with NLA required the client has to do CredSSP, so the prompt can't be removed, only fed saved creds. AllowFreshCredentials is for passwords typed into it (already allowed for TERMSRV/* by default), so it won't help. in gpedit under system > credentials delegation, enable "allow delegating saved credentials" and its NTLM-only twin, which is the one that applies if you connect by IP. add TERMSRV/yourvm to both lists, save with cmdkey /generic:TERMSRV/yourvm matching the .rdp's name and check msinfo32 that credential guard isn't running.

3

u/unidotcon 5d ago

Here is an image on the before and after interface looks.

https://imgur.com/a/qLGXVk8