Copy/Paste Blocked During Logon and UAC Elevation on Azure Windows Server 2019 VM

Question

Copy/Paste Blocked During Logon and UAC Elevation on Azure Windows Server 2019 VM

Joel Reis 0

I'm experiencing clipboard restrictions on an Azure-hosted Windows Server 2019 Datacenter VM (latest version) in two specific scenarios:

During logon screen - cannot paste credentials or text
When elevating privileges - clipboard access is blocked when UAC prompts appear (e.g., opening Task Manager as administrator)

Environment:

Windows Server 2019 Datacenter (latest patches)
Hosted on Azure VM
Accessing via RDP

What I've checked:

RDP client settings appear correct
Issue persists across different elevation scenarios
Occurs consistently, not intermittent

Questions:

Is this caused by Azure Security Baseline policies or CIS benchmarks being applied?
Could this be Secure Desktop isolation blocking clipboard during UAC prompts?
Are there specific Azure-level policies overriding local RDP clipboard settings?
What's the recommended approach to diagnose which GPO or policy is responsible?

Any guidance on identifying the root cause and potential solutions (while maintaining reasonable security posture) would be appreciated.I'm experiencing clipboard restrictions on an Azure-hosted Windows Server 2019 Datacenter VM (latest version) in two specific scenarios:During logon screen - cannot paste credentials or textWhen elevating privileges - clipboard access is blocked when UAC prompts appear (e.g., opening Task Manager as administrator)**Environment:Windows Server 2019 Datacenter (latest patches)Hosted on Azure VMAccessing via RDPWhat I've checked:RDP client settings appear correctIssue persists across different elevation scenariosOccurs consistently, not intermittentQuestions:**Is this caused by Azure Security Baseline policies or CIS benchmarks being applied?Could this be Secure Desktop isolation blocking clipboard during UAC prompts?Are there specific Azure-level policies overriding local RDP clipboard settings?What's the recommended approach to diagnose which GPO or policy is responsible?Any guidance on identifying the root cause and potential solutions (while maintaining reasonable security posture) would be appreciated.

0 comentários

1 resposta

Sua resposta

Answer 1

Welcome to the Microsoft Q&A Platform!

Based on your questions, I would like to provide some information to help you address your issue that you encountered.

1. Is this caused by Azure Security Baseline policies or CIS benchmarks being applied?

Azure Security Baseline policies and CIS benchmarks may enforce clipboard restrictions as part of hardening. Please kindly review your applied baselines and benchmarks for clipboard settings and override if business needs require clipboard access.

2. Could this be Secure Desktop isolation blocking clipboard during UAC prompts?

Clipboard access is intentionally blocked at the Windows logon screen and during UAC elevation (Secure Desktop) for security reasons. This is by design in Windows Server 2019 and cannot be overridden without reducing security.

See Microsoft’s documentation: “Starting in Windows Server 2019, it’s not possible to paste the content of the clipboard on the secure desktop. This behavior is the same as the currently supported Windows client OS versions.”

Reference: How User Account Control works | Microsoft Learn

3. Are there specific Azure-level policies overriding local RDP clipboard settings?

Azure Policy can also restrict clipboard redirection at the subscription or resource group level. Please review Azure Policy assignments for relevant restrictions.

4. What's the recommended approach to diagnose which GPO or policy is responsible?

GPO

Looking for settings under:

Computer Configuration > Policies > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Device and Resource Redirection

And then, checking for the policy “Do not allow Clipboard redirection”

If set to Enabled, clipboard redirection is blocked. Set it to Disabled or Not Configured to allow clipboard use.

Registry key

Checking the registry at the below:

HKLM\Software\Microsoft\Terminal Services Client_DisableClipboardRedirection_ (should be 0 to allow clipboard).

Reference: Configure clipboard redirection over the Remote Desktop Protocol - Azure Virtual Desktop | Microsoft Learn

5. Any guidance on identifying the root cause and potential solutions (while maintaining reasonable security posture)?

Clipboard is always blocked at logon and UAC elevation (Secure Desktop) by design.
For other scenarios, check GPOs, registry, Azure Policy and security baselines as recommend above.
If you use FSLogix or other profile/container solutions, ensure they are not enforcing additional clipboard restrictions.
For issues after updates, ensure new executables like rdpclipcdv.exe are not blocked by AppLocker or antivirus policies. Reference: Device redirections in Azure Virtual Desktop - Azure Virtual Desktop | Microsoft Learn

I hope this information can help you to finish it successfully. Wish you a pleasant day!