We also opened a support case on 2022-01-14, and provided a reproduction scenario on 19-02-2022 ...
Remote Credential Guard double-hop issue after server 2022 upgrade
Robert Ro
36
Reputation points
we upgraded two of our jump/admin servers from server 2019 to server 2022. one was installed fresh, the other one was upgraded via inplace upgrade.
now mstsc /remoteguard no longer works correctly, we seem to run into a kerberos double-hop issue.
what we do is, we logon to the admin server as usual with credentials. then from the admin server we use mstsc /remoteguard to jump to a different machine. on the destination machine, upon opening network shares we receive the message:
"The system cannot contact a domain controller to service the authentication reuqest. Please try again later."
this did not happen before the upgrade. everything still works fine when starting from a server 2019 admin server.
no group policies, security settings or other modifications were done the infrastructure.
anyone else experiencing this?
Windows for business | Windows Client for IT Pros | User experience | Remote desktop services and terminal services
Windows for business | Windows Server | User experience | Other
Windows for business | Windows Server | Devices and deployment | Configure application groups
14 answers
Sort by: Newest
-
Robert Ro 36 Reputation points
2022-03-14T10:27:37.393+00:00 We opened a support case on 2022-02-22 but so far no resolution.
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(99.2, 85%, 19%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ESP%3C/text%3E%3C/svg%3E)
SIMONS Philippe 1 Reputation point2022-03-14T10:14:17.78+00:00 Similar issue here, using Windows 10 21H2 after applying January Patch Tuesday Update (KB5009543) as source of RDP (destination machine is Windows Server 2019 or 2022.)
A work arround is to Lock / Unlock the remote session (CTRL+ALT+END) ... but I imagine then you are not relying on RGC but local Authentication. -
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(108.80000000000001, 81%, 20%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ESK%3C/text%3E%3C/svg%3E)
Simon Kleinl-Roscic 1 Reputation point2022-03-10T10:00:08.003+00:00 Same problem here: when using an Windows Server 2022 jump/admin host to connect to other machines using mstsc /remoteguard then we run in the kerberos double hop issue as robert described (you can´t access file shares, ...). It doesn´t matter if the destination machine is Windows Server 2016, 2019 or 2022. If you use an Windows Server 2016 or 2019 jump/admin host to connect to other machines using mstsc /remoteguard, then everything works as expected (access to file shares works, ...).