Windows 10 – Fix Remote Desktop Sound/Drive Redirection Issues

i found the solution. It was at the same time both subtle, and obvious.

As mentioned in the question, when i was modifying the following Remote Desktop Connection Client Group Policy settings:

• Prompt for credentials on the client computer
• Do not allow passwords to be saved

i was checking them on the server:

i thought it would be the server that dictates what the client is allowed to do. Turns out that is completely wrong. It was @mpy's answer (while incorrect), which led me to the solution. i shouldn't be looking at the RDP client policy on the RDP server, i need to look at the RDP client policy on my RDP client machine:

On my client Windows 7 machine, the policy was:

• Do not allow passwords to be saved: Enabled
• Prompt for credentials on the client computer: Enabled

i do not know when these options were enabled (i did not enable them in recent memory). The confusing part is that even though

Do not allow passwords to be saved

is Enabled, the RDP client would still save password; but only for servers below Windows Server 2008.

The truth table of functioning:

Do not allow saved  Prompt for creds  Works for 2008+ servers  Works for 2003 R2- servers
==================  ================  =======================  ==========================
Enabled             Enabled           No                       Yes
Enabled             Not Configured    No                       No
Not Configured      Enabled           Yes                      Yes
Not Configured      Not Configured    Yes                      Yes

So there is the trick. The group policy settings under:

Computer Configuration\Policies\Administrative Templates\Windows Components\Terminal Services\Remote Desktop Connection Client

on the client machine need to be configured with:

• Do not allow passwords to be saved: Not Configured (critical)
• Prompt for credentials on the client computer: Not Configured

The other source of confusion is that while

• a domain Enabled policy cannot override a local Disabled
• a domain Disabled policy can be overridden by a local Enabled policy

Which again leads to a truth table:

Domain Policy   Local Policy    Effective Policy
==============  ==============  ==============================
Not Configured  Not Configured  Not configured (i.e. disabled)
Not Configured  Disabled        Disabled
Not Configured  Enabled         Enabled
Disabled        Not Configured  Disabled
Disabled        Disabled        Disabled
Disabled        Enabled         Disabled (client wins)
Enabled         Not Configured  Enabled
Enabled         Disabled        Enabled (domain wins)
Enabled         Enabled         Enabled

Thanks to Sam Jones' links, there appears to be three possible solutions:

• Using the Remote Desktop app (via the Microsoft Store)

  This appears to be the most flexible option.

  While setting up the connection, simply configure the Display Settings to the desired resolution. Additionally, "Change the size of the display" should be set to 100% to disable any remote DPI scaling. When entering full screen, the display is automatically stretched locally.

• Using the native Remote Desktop Connection client (mstsc)

  Unfortunately, it's not possible to enter full screen mode while zooming with this method. Mostly, this means some keyboard shortcuts will not be captured.

  1. Before connecting, set the resolution (e.g. to 1920x1080) in the Display tab of the connection settings dialog. This is the crucial step for determining the resolution sent over the network.

  2. After connecting, right-click on the title bar and set the Zoom:

     

• Using mRemoteNG, a third-party client

  I have not yet figured out how to stretch (zoom) locally. However, if the resolution of the connection is set, there appears to be DPI scaling applied locally resulting in a readable display with minimal data sent over the network.

  For example, I can set 1920x1080, which will be the remote resolution. Then my default 150% DPI scaling is applied locally, resulting in ~2880x1620. Some black borders remain but it's usable.