Troubleshooting: Windows SSO Fails When Connected via VPN, Dial-Up, or a USB Data Dongle

Version Affected: All
 
 

Overview

Users connected through a Windows Remote Access Server (RAS) connection — such as a VPN, dial-up, or a USB data dongle (GPRS, 3G, 4G, and similar) — fail to authenticate against a realm with Windows Single Sign-On (SSO) enabled, and are shown a Windows credentials prompt instead.

Cause

This typically happens when the username and/or password used for the RAS connection differs from the user's domain credentials. By default, Windows uses the RAS connection's credentials for automatic logon and Windows SSO, instead of the credentials used to interactively log on to the machine.

Resolution

1. Open the following file in a text editor (usually named rasphone.pbk):
   %USERPROFILE%\AppData\Roaming\Microsoft\Network\Connections\Pbk\*.pbk
2. Find the line:
   UseRasCredentials=1
   and change it to:
   UseRasCredentials=0
3. Save the file.

Special Considerations

It may be necessary to disconnect the RAS connection before editing the file above.

Some devices install their own software to initiate and manage the connection. This software may overwrite the .pbk file each time a connection starts, undoing any changes made — this is particularly common with USB dongles. If this happens, manually create a connection from the Network and Sharing Center and use that to initiate and manage the connection instead of the software supplied with the device.


 

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.