can log on HTML5 web site

Question

can log on HTML5 web site

Misko Stanivukovich 25

Hello I have deployed RDS, and I also have installed HTML5

packageId : rd-html5 version : 2.1.65.0 author : Microsoft summary : The Remote Desktop Web Client minRDWebClientManagementVersion : 1.0.4 path : C:\Program Files\RemoteDesktopWeb\Internal\Clients\x4isi5i1.oca _baseVersion : 2.1.65.0 publishedAs : {}

I can log on to RDWeb/Pages but when I try to log to RDWeb/webclient it is rejecting my log in credentials which are the same

2 answers

Your answer

Answer 1

Hi Misko Stanivukovich,

Thanks for the update, and great job getting the HTML5 Web Client installed!

From what you’ve described, you’re able to log in successfully at /RDWeb/Pages, but login fails at /RDWeb/webclient using the same credentials. This usually points to a configuration issue specific to the HTML5 client.

In my understanding, The HTML5 Web Client has stricter requirements for authentication and deployment linkage. Even if RDWeb/Pages works, the HTML5 client may reject logins due to:

Missing or unpublished web client package
RD Gateway misconfiguration
User permissions not correctly set
SSO or credential caching conflicts
Certificate trust issues

Here are a few things to check to help resolve this:

1. Verify Web Client Is Published

Run:

Get-RDWebClientPackage

If not published:

Publish-RDWebClientPackage -Type Production -Latest

Reference: Set up the Remote Desktop Web Client

2. Use the Correct Login URL

Make sure you're accessing:

https://<YourServerFQDN>/RDWeb/webclient/index.html

Some browsers don’t redirect properly if /index.html is missing.

3. Check RD Gateway Configuration

The HTML5 client uses RD Gateway for external access. Ensure:

RD Gateway is enabled and reachable
Certificate is valid and trusted
Gateway settings are configured in the deployment

I managed to find this thread with a similar issue, please take a look at the solutions when you have the time: RemoteApp WebClient Launch Failure

4. Review User Permissions

Make sure the user:

Is part of the Remote Desktop Users group
Is assigned to the RemoteApp collection

Reference: RDWeb login OK, but RemoteApp says credentials are wrong

5. Check for SSO Conflicts

If SSO is enabled and the user recently changed their password, registry settings like ForceSilentTSAutoLogon can block login.

Reference: SSO Login Failure Troubleshooting

6. Try a Different Browser or InPrivate Mode

Sometimes cached credentials or certificate trust issues can interfere. Testing in a clean browser session can help isolate the issue.

Let me know what you find after trying these steps. If login still fails, feel free to share any error messages or screenshots, and I’ll help you dig deeper.

Answer 2

Misko Stanivukovich 25

It is having same issue

An account failed to log on.

Subject:

Security ID:		NULL SID

Account Name:		-

Account Domain:		-

Logon ID:		0x0

Logon Type: 3

Account For Which Logon Failed:

Security ID:		NULL SID

Account Name:		test

Account Domain:		dc01

Failure Information:

Failure Reason:		An Error occured during Logon.

Status:			0xC000006D

Sub Status:		0x0

Process Information:

Caller Process ID:	0x0

Caller Process Name:	-

Network Information:

Workstation Name:	TC-XXXXX

Source Network Address:	131.176.170.130

Source Port:		51038

Detailed Authentication Information:

Logon Process:		

Authentication Package:	NTLM

Transited Services:	-

Package Name (NTLM only):	-

Key Length:		0

This event is generated when a logon request fails. It is generated on the computer where access was attempted.

The Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).

The Process Information fields indicate which account and process on the system requested the logon.

The Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The authentication information fields provide detailed information about this specific logon request.

- Transited services indicate which intermediate services have participated in this logon request.

- Package name indicates which sub-protocol was used among the NTLM protocols.

- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.

Tom Tran (WICLOUD CORPORATION) 260 Reputation points Microsoft External Staff

2025-08-07T03:10:47.69+00:00
Hi Misko Stanivukovich,

Thanks for sharing the error log, it helps a lot!

This is a common issue when setting up the HTML5 Web Client for Remote Desktop, and it’s usually caused by a small configuration step being missed. The logs:

An account failed to log on. Status: 0xC000006D Logon Type: 3 Authentication Package: NTLM

This means the system received your login request but couldn’t verify the credentials. It’s not that the username or password is wrong, it’s more likely that the HTML5 Web Client isn’t fully connected to the rest of your RDS setup. Here are some common fixes:

1. Make Sure the Web Client Is Published

I know I already provided it in my last response, but I need confirmation you have done this step. Even if the client is installed, it won’t work until it’s published.

To check and publish it:

Open PowerShell as Administrator

Run:

Get-RDWebClientPackage Publish-RDWebClientPackage -Type Production -Latest

Publish the Web Client – Microsoft Docs

2. Confirm the User Is Assigned to a Collection

The HTML5 client only allows logins for users who are:

In the Remote Desktop Users group

Assigned to a RemoteApp or Session Collection

To check this:

On your RD Connection Broker, open Server Manager > Remote Desktop Services > Collections

Make sure the user account is listed under the correct collection

Manage user accounts in Active Directory Users and Computers – Microsoft Docs

3. Verify RD Gateway Configuration

The HTML5 client requires RD Gateway, even for internal access. If the Gateway isn’t set up or the certificate isn’t trusted, login will silently fail.

To check this:

Open Server Manager > Remote Desktop Services > Overview

Click Edit Deployment Properties

Go to the RD Gateway tab and confirm:

RD Gateway is enabled

The certificate is valid and trusted

The FQDN is reachable from the client

Configure RD Gateway for Web Client – Microsoft Docs

4. Try a Clean Browser Session

Sometimes cached credentials or certificate issues can interfere. So try:

Open the web client in InPrivate/Incognito mode

Or use a different browser to test

I know I am repeating some of the steps, but I need you to confirm:

If the web client was successfully published

Whether the user is part of a RemoteApp or Session Collection

If the RD Gateway is enabled and reachable

And whether you’ve tried logging in from a private browser session

This way we can narrow down the issue you are having.

Let me know how it goes after trying these steps! If it still doesn’t work, I’ll be happy to dig deeper with you.
Misko Stanivukovich 25 Reputation points

2025-08-07T09:13:54.8433333+00:00

Hello I have try the above 4 steps all is ok but still same
Tom Tran (WICLOUD CORPORATION) 260 Reputation points Microsoft External Staff

2025-08-07T10:47:50.36+00:00
Hi Misko Stanivukovich,

Thanks for the confirmation - I really appreciate your effort!

Since the issue is still happening, we’ll need to dig a little deeper to pinpoint what’s blocking the login.

Confirm the User Is in the Right AD Group

Can you verify that the user account (test from domain dc01) is a member of the Remote Desktop Users group in Active Directory?

Manage user accounts in Active Directory Users and Computers

Check RD Gateway Authentication Settings

Open Server Manager > Remote Desktop Services > Overview > Edit Deployment Properties, then go to the RD Gateway tab and confirm:

RD Gateway is enabled

The authentication method is set to Password (not Smart Card or custom)

The certificate is valid and trusted by the client machine

Configure RD Gateway for Web Client – Microsoft Docs

Test Classic RDWeb Login with RemoteApp

Try logging in to /RDWeb/Pages and launching a RemoteApp or desktop. If this fails too, it confirms the issue is not specific to the HTML5 client but likely related to user access or gateway configuration.

Review Event Viewer Logs on RD Gateway and Broker

On the RD Gateway and RD Connection Broker servers, open:

Event Viewer > Windows Logs > Application

Event Viewer > Windows Logs > Security

Look for:

Audit failures

Credential delegation errors

Kerberos or NTLM authentication issues

These logs can help us trace where the login is being rejected.

Let me know what you find from these steps especially the Event Viewer logs. We can walk through the logs together.
Misko Stanivukovich 25 Reputation points

2025-08-07T11:35:08.36+00:00
I can confirm I have cheeked the 3 steps above all is good I can access the rd page with credentials, from the event viiewer the logs:

Process ID: 1664 Process name: w3wp.exe Account name: IIS APPPOOL\RDWebAccess

Exception information:

Exception type: NullReferenceException Exception message: Object reference not set to an instance of an object.

at Microsoft.TerminalServices.Publishing.Portal.FormAuthentication.TSFormAuthTicketInfo..ctor(HttpContext objHttpContext)

at ASP.en_us_default_aspx.<GetAppsAsync>d__0.MoveNext()

--- End of stack trace from previous location where exception was thrown ---

at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()

at System.Web.UI.PageAsyncTaskManager.<ExecuteTasksAsync>d__3.MoveNext()

--- End of stack trace from previous location where exception was thrown ---

at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()

at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)

at System.Web.UI.Page.<ProcessRequestAsync>d__554.MoveNext()

Request information:

Request URL: https://xxxxxxxxxx:443/RDWeb/Pages/en-US/default.aspx Request path: /RDWeb/Pages/en-US/default.aspx User host address: 10.181.216.97 User: Is authenticated: False Authentication Type: Thread account name: IIS APPPOOL\RDWebAccess

An account failed to log on. Subject: Security ID: NULL SID Account Name: - Account Domain: - Logon ID: 0x0 Logon Type: 3 Account For Which Logon Failed: Security ID: NULL SID Account Name: test Account Domain: dc01 Failure Information: Failure Reason: An Error occured during Logon. Status: 0xC000006D Sub Status: 0x0 Process Information: Caller Process ID: 0x0 Caller Process Name: - Network Information: Workstation Name: TC-XXXXXX Source Network Address: 131.176.170.130 Source Port: 53358 Detailed Authentication Information: Logon Process: Authentication Package: NTLM Transited Services: - Package Name (NTLM only): - Key Length: 0

This is all I have found
Tom Tran (WICLOUD CORPORATION) 260 Reputation points Microsoft External Staff

2025-08-08T03:36:52.7166667+00:00
Hi Misko Stanivukovich,

Thank you for sharing the detailed Event Viewer logs, very helpful in narrowing this down. Based on the error:

Exception type: NullReferenceException at Microsoft.TerminalServices.Publishing.Portal.FormAuthentication.TSFormAuthTicketInfo..ctor(HttpContext objHttpContext)

and the Security log (Status: 0xC000006D, Authentication Package: NTLM), this indicates the HTML5 Web Client is failing during the authentication ticket creation process in RDWeb. This usually happens when:

IIS authentication settings or RDWeb configuration are misaligned

There’s a corruption in the RDWeb/HTML5 deployment.

Please go through these steps accordingly:

1. Check IIS Authentication Settings

Open IIS Manager→Sites→Default Web Site→RDWeb→Pages.

Under Authentication:

Windows Authentication = Enabled

Anonymous Authentication = Disabled

Forms Authentication should NOT be enabled.

If you make changes, restart IIS:

iisreset

RDWeb relies on Windows Authentication to create a secure session ticket. If Anonymous or Forms Authentication is enabled, RDWeb cannot generate the ticket, causing the NullReferenceException.

Reference: Configure Authentication in IIS

2. Reset RDWeb Configuration

If any custom web.config exists in:

C:\Windows\Web\RDWeb\Pages

C:\Program Files\RemoteDesktopWeb\Internal\Clients

rename it (e.g., web.config.old) and restart IIS.

If corruption is suspected, reinstall RD Web Access:

Uninstall-WindowsFeature RDS-Web-Access Install-WindowsFeature RDS-Web-Access

Corrupted or custom web.config files can break the authentication pipeline. Resetting ensures RDWeb uses the default configuration.

3. Verify RDWebAccess App Pool Settings

In IIS → Application Pools → RDWebAccess:

.NET CLR Version = v4.0

Managed Pipeline Mode = Integrated

Identity = Network Service (or default)

RDWeb requires .NET CLR v4.0 and Integrated pipeline mode. If these are wrong, the ASP.NET components fail to process authentication.

Reference: Application Pools settings

4. Repair HTML5 Web Client

Unpublish and republish the HTML5 Web Client:

Unpublish-RDWebClientPackage Publish-RDWebClientPackage -Type Production -Latest

Republishing refreshes internal files and fixes broken references that can occur after updates or partial installs.

5. Advanced Checks (Optional)

If the issue persists after the steps above or if you’re in a domain environment using RD Gateway, please check:

Kerberos/SPN Validation

Kerberos is the default authentication protocol in AD. If SPNs are missing or misconfigured, Kerberos fails and falls back to NTLM (as seen in your logs).

setspn -L <RD Gateway Server>

You should see:

HTTP/<FQDN> HTTP/<ShortName> TERMSRV/<FQDN> TERMSRV/<ShortName>

If missing, add them:

setspn -S HTTP/<FQDN> <ServerName> setspn -S HTTP/<ShortName> <ServerName> setspn -S TERMSRV/<FQDN> <ServerName> setspn -S TERMSRV/<ShortName> <ServerName>

Reference:

Kerberos Authentication Overview

Setspn Tool

RD Gateway CAP/RAP Policies

In RD Gateway Manager, confirm:

The user/group is allowed in Connection Authorization Policies (CAP).

The target resources are allowed in Resource Authorization Policies (RAP).

Reference: Configure RD Gateway CAP and RAP

I managed to find these fixes. Please after you have tried it, tell me how it goes.

If the issue still persists, let me know right away!
Misko Stanivukovich 25 Reputation points

2025-08-08T08:22:22.3233333+00:00
This part is not configurated and it is returning error:

FindDomainForAccount: Call to DsGetDcNameWithAccountW failed with return value 0x00000525 Could not find account xxxxx

Regarding the power shell commands are from Domain controller power shell to the host or opposite

Could not find account tc-testlab.tecm.esa.int

5. Advanced Checks (Optional)

If the issue persists after the steps above or if you’re in a domain environment using RD Gateway, please check:

Kerberos/SPN Validation

Kerberos is the default authentication protocol in AD. If SPNs are missing or misconfigured, Kerberos fails and falls back to NTLM (as seen in your logs).

SQLCopy

setspn -L <RD Gateway Server>

You should see:

JSONCopy

HTTP/<FQDN> HTTP/<ShortName> TERMSRV/<FQDN> TERMSRV/<ShortName>

If missing, add them:

PowerShellCopy

setspn -S HTTP/<FQDN> <ServerName> setspn -S HTTP/<ShortName> <ServerName> setspn -S TERMSRV/<FQDN> <ServerName> setspn -S TERMSRV/<ShortName> <ServerName>
Tom Tran (WICLOUD CORPORATION) 260 Reputation points Microsoft External Staff

2025-08-08T09:35:42.72+00:00
Hi Misko Stanivukovich,

The message:

FindDomainForAccount: DsGetDcNameWithAccountW failed (0x00000525) Could not find account tc-testlab.tecm.esa.int

means the RD Web Client or RD Gateway cannot locate this account in Active Directory. This is an Active Directory lookup issue, not an HTML5 Web Client configuration problem. The Web Client depends on AD and RD Gateway for authentication, so if the account cannot be resolved, the Web Client will fail regardless of IIS or HTML5 settings. Missing or misconfigured SPNs when Kerberos is in use.

Please try out these steps:

Confirm the account exists and is enabled

Run this on a domain controller or any domain-joined machine with the Active Directory module (RSAT):

Get-ADUser -Identity "tc-testlab.tecm.esa.int" -Properties Enabled

Expected:

DistinguishedName : CN=tc-testlab,OU=Users,DC=tecm,DC=esa,DC=int Enabled : True Name : tc-testlab SamAccountName : tc-testlab UserPrincipalName : ******@tecm.esa.int

If you see an error like:

Get-ADUser : Cannot find an object with identity: 'tc-testlab.tecm.esa.int'

It means the account does not exist or the UPN is incorrect.

Check domain controller connectivity

Run this on the RD Gateway or RD Web Access server (because we need to confirm these servers can reach a domain controller):

nltest /dsgetdc:tecm.esa.int

Expected:

DC: \DC01.tecm.esa.int Address: \10.x.x.x Domain Name: tecm.esa.int The command completed successfully

If you see:

DsGetDcName failed: Status = 1355 0x54b ERROR_NO_SUCH_DOMAIN

There is a DNS or trust issue between the server and the domain.

Test login on RDWeb/Pages

Try logging into RDWeb/Pages with the same account.

If this fails, the issue is with AD authentication, not the HTML5 Web Client.

SPN Check (Kerberos)

If the account exists and domain connectivity works, check SPNs for the RD Gateway server. Run this on a domain controller or any machine with RSAT tools:

setspn -L <RD Gateway ServerName>

You should see entries like:

HTTP/<FQDN> HTTP/<ShortName> TERMSRV/<FQDN> TERMSRV/<ShortName>

If any are missing, add them:

setspn -S HTTP/<FQDN> <ServerName> setspn -S HTTP/<ShortName> <ServerName> setspn -S TERMSRV/<FQDN> <ServerName> setspn -S TERMSRV/<ShortName> <ServerName>

Please share when you have tried out these steps:

Output of Get-ADUser (or the error if it fails)

Output of nltest /dsgetdc:tecm.esa.int

Output of setspn -L <RD Gateway ServerName>

This will confirm whether the issue is account-related, DNS/trust-related, or SPN-related.
Tom Tran (WICLOUD CORPORATION) 260 Reputation points Microsoft External Staff

2025-08-12T03:40:01.16+00:00

Hi Misko Stanivukovich,

Just checking if you have your issue resolved! If you have any more issue please let me know!

Share via

can log on HTML5 web site

2 answers

Your answer