MSA RDP Login Helper

English | 简体中文

MSA RDP Login Helper is a small native Windows C++ utility. After the current Windows user signs in or unlocks the workstation, it reads a Microsoft-account credential from Windows Credential Manager and runs a harmless whoami command under that Microsoft account.

This can establish or refresh local Microsoft-account password authentication on Windows machines where RDP sign-in as MicrosoftAccount\email@example.com initially fails because the credential has not yet been cached locally.

This tool does not enable or configure Remote Desktop. It does not change firewall rules, ports, local groups, the registry, or router settings. You remain responsible for configuring and securing the RDP host.

Features

• Uses the Windows credential dialog during initial setup.
• Stores the password as a current-user, machine-local CRED_TYPE_GENERIC credential.
• Runs after both user sign-in and workstation unlock.
• Uses CreateProcessWithLogonW instead of placing a password on a command line.
• Registers a least-privileged, per-user scheduled task with no task password.
• Supports installation, manual authentication, status inspection, and removal.
• Writes size-limited diagnostic logs without account names or passwords.

How it works

1. --install stores the credential in the current Windows user's Credential Manager.
2. The executable is copied to %LOCALAPPDATA%\MsaRdpLoginHelper\MsaRdpLoginHelper.exe.
3. A scheduled task whose name includes the current user's SID is registered for sign-in and workstation-unlock events.
4. On each trigger, the program reads the credential with CredReadW and calls CreateProcessWithLogonW using:
   • user name: the Microsoft-account email address;
   • domain: MicrosoftAccount;
   • command: the system cmd.exe /d /c whoami.
5. The hidden command is allowed up to 30 seconds to finish. The password is never placed in task XML, process arguments, configuration files, or logs.

Requirements

• Windows 10, Windows 11, or a compatible Windows Server release
• x64 system
• To build from source: Visual Studio 2022 Build Tools with:
  • Desktop development with C++
  • MSVC v143 toolset
  • Windows 10/11 SDK
• The Microsoft account must be allowed to sign in locally on the host

A Windows Hello PIN is not a Microsoft-account password. Enter the actual account password during setup.

Download

Prebuilt x64 packages and SHA-256 checksums are published on the Releases page.

The binaries are produced by the repository's GitHub Actions workflow and are currently unsigned. Windows SmartScreen may therefore display a warning.

Build

Run the following command in PowerShell:

& 'C:\Program Files (x86)\Microsoft Visual Studio\2022\BuildTools\MSBuild\Current\Bin\MSBuild.exe' `
  .\MsaRdpLoginHelper.vcxproj `
  /m /p:Configuration=Release /p:Platform=x64

Output:

bin\x64\Release\MsaRdpLoginHelper.exe

Usage

Install

.\MsaRdpLoginHelper.exe --install 'you@example.com'

The Windows credential dialog displays MicrosoftAccount\you@example.com. Confirm the account and enter its real password. The installed scheduled task uses the copy under %LOCALAPPDATA%, so the downloaded executable does not need to remain in its original directory.

Test authentication manually

.\MsaRdpLoginHelper.exe --authenticate 'you@example.com'

Exit code 0 means the authentication command completed successfully. No visible child window is created.

Inspect status

.\MsaRdpLoginHelper.exe --status 'you@example.com'

This checks whether the credential and current user's scheduled task exist. It never displays or exports the password.

Uninstall

.\MsaRdpLoginHelper.exe --uninstall 'you@example.com'

This removes the scheduled task and the matching Credential Manager entry created by the tool. It does not disable RDP or change any RDP configuration.

Logs

%LOCALAPPDATA%\MsaRdpLoginHelper\logs\MsaRdpLoginHelper.log

• Logs are UTF-8 and contain local timestamps, process IDs, severity levels, operation stages, and numeric Windows/HRESULT error codes.
• At 1 MiB, the main log rotates to MsaRdpLoginHelper.log.1; one archive is retained.
• Email addresses, account names, passwords, credential blobs, and complete command lines are not logged.
• A logging failure is ignored so it cannot block authentication or removal.

Troubleshooting

Win32 error 1326 from CreateProcessWithLogonW

The account or password is incorrect, or the Windows build cannot resolve the supplied Microsoft-account alias. Run --install again to replace the saved password, and use the real Microsoft-account password rather than a PIN.

Win32 error 1385 from CreateProcessWithLogonW

The account lacks the “log on locally” right, or a local/domain security policy denies the requested logon type.

RDP still cannot connect

This utility only triggers Microsoft-account authentication. Separately verify that the Windows edition can host RDP, Remote Desktop is enabled, the account has remote-logon rights, and the firewall permits traffic. Prefer a VPN or RD Gateway; do not expose TCP 3389 directly to the public internet.

Locate the saved credential

Open Control Panel → Credential Manager → Windows Credentials and look for a target beginning with:

MsaRdpLoginHelper/MicrosoftAccount/

Security boundary

• Credential Manager protects the password at rest and isolates it by Windows user. Malware running as that same user may still be able to read generic credentials.
• The password must briefly exist in process memory while it is passed to the Windows logon API. Password buffers are cleared after use.
• The installed executable is under the current user's writable %LOCALAPPDATA% directory and is not an administrator security boundary.
• The tool does not bypass NLA, Windows security policy, RDP session limits, or multifactor authentication.

See SECURITY.md for the security policy.

Continuous integration and releases

On every push or merge to master, GitHub Actions:

1. builds Release x64 with Visual Studio 2022/MSBuild;
2. runs a command-line smoke test;
3. packages the executable and bilingual documentation;
4. creates a SHA-256 checksum file;
5. uploads a workflow artifact and publishes a build-<run number> GitHub Release.

A manual workflow run builds and uploads the artifact without publishing a Release.

Project layout

.github/workflows/build-release.yml  Windows build and release workflow
MsaRdpLoginHelper.vcxproj            Visual Studio/MSBuild project
src/main.cpp                         Application implementation
README.md                            English documentation
README.zh-CN.md                      Simplified Chinese documentation
SECURITY.md                          English security policy
SECURITY.zh-CN.md                    Simplified Chinese security policy
LICENSE                              MIT License

References

• CredUIPromptForCredentialsW
• CredWriteW
• CredReadW
• CreateProcessWithLogonW
• Task Scheduler session-state change trigger

License

MIT