Your network contains an Active Directory domain named adatum.com.
You publish a RemoteApp named Webapp1. The Remote Desktop Connection (.rdp) file for Webapp1 is unsigned.
When a user named User1 runs Webapp1 from the Remote Desktop Web access (RD web Access) website, User1 is prompted for credentials.
You need to prevent users from being prompted for credentials when they run Webapp1.
What should you do?
A. Enable form-based authentication for the Remote Desktop Web Access Website.
B. Enable the Assign a default domain for logon Group Policy setting.
C. Modify the Authentication Settings for the RDWeb virtual directory.
D. Enable the Allow Delegating Default credentials Group Policy setting.
E. Configure the SSL Settings for the RDWeb virtual directory.
Correct Answer: D
Explanation/Reference:
When applied to Terminal Services, Single Sign-On means using the credentials of the currently logged on user (also called default credentials) to log on to a remote computer. If you use the same user name and password logging on to your local computer and connecting to a Terminal Server, enabling Single Sign-On will allow you to do it seamlessly, without having to type in your password again.
Locally logged on credentials are used for connecting to TS Web Access, however, they cannot be shared across TS Web Access and TS or TS Gateway. Thus you will need to enable the Group Policy settings described below in order to use locally logged on credentials for TS or TS Gateway connections.
How to enable Single Sign-On?
Single sign-On can be enabled using domain or local group policy.
1. Log on to your local machine as an administrator.
2. Start Group Policy Editor – "gpedit.msc".
3. Navigate to "Computer ConfigurationAdministrative TemplatesSystemCredentials Delegation".
4. Double-click the "Allow Delegating Default Credentials" policy.
5. Enable the policy and then click on the "Show" button to get to the server list.
6. Add "TERMSRV/<Your server name>" to the server list. You can add one or more server names. Using one wildcard (*) in a name is allowed. For example to enable Single Sign-On to all servers in "MyDomain.com" you can type "TERMSRV/*.MyDomain.com". (Notice the "Concatenate OS defaults with input above" checkbox on the picture above. When this checkbox is selected your servers are added to the list of servers enabled by OS by default. For Single Sign-On this default list is empty, so the checkbox has no effect.)
7. Confirm the changes by clicking on the "OK" button until you return back to the main Group Policy Object Editor dialog.
8. At a command prompt, run "gpupdate" to force the policy to be refreshed immediately on the local machine.
9. Once the policy is enabled you will not be asked for credentials when connecting to the specified servers.
http://blogs.msdn.com/b/rds/archive/2007/04/19/how-to-enable-single-sign-on-for-my-terminal-server- connections.aspx
