Hello to all following this thread. I believe I have the fix for those experiencing this issue since installing the 26100.5074 (KB5064081) preview build or 26100.6584 (KB5065426) that was released to the public yesterday. This also affects RDP Remote Desktop. (Trying to list as many related terms as possible for SEO).
Take a look in your System Event Log on the target machine and see if you see the following error when you try to connect remotely:
Code:
LSA(LsaSrv) Event ID 6167 "There is a partial mismatch in the machine ID. This indicates that the ticket has either been manipulated or it belongs to a different boot session. Failing authentication."
If you're getting the above, download
PsGetSid, included with PsTools and check the SID on all affected machines. They should all be different, but if any of them match each other, that is what's causing this issue to occur. This update seems to change the way auth hashes are mapped, and instead of using hostnames, it is now using the SID.
The SID can be changed using a utility called
SIDCHG, which is not technically free, but they do allow for a 30-day evaluation using a trial key on that page that they appear to update monthly. It does it fairly nondestructively, moreso than sysprep, but it will wipe any credentials stored in your vault, and could affect some licensed software and the like, it may need to be reactivated (i.e. Adobe products).
sysprep /generalize will also accomplish an SID change, but will wipe a lot more (drivers, computer name, any encrypted files, some settings, and like above will also wipe vault credentials and can affect software activation etc.
For this reason, if you're having this issue across only 2 machines, you could always just change 1 instead of both, and choose to do it on the one that has less potential things to have to set back up (although depending on how you ended up with duplicate SIDs in the first place, not changing all affected PCs could lead to this happening again in the future if another new PC is introduced with that same SID).
In my case, the issue was occurring across 4 identical PCs that came from the same OEM at the same time. Not sure what they did in their imaging process to cause it, but all 4 did have identical SIDs. Properly sysprepped images should not have this happen, but this could definitely result from things like drive clones and restoring a different PC from anothers' full-drive backup.
