Chris_Wentland
Nimbostratus
NimbostratusSLGizmo - If you do Two Factor Auth, be sure to capture the original login credentials. When you do two factor auth, the session.logon.last.password typically gets overwritten with the TFA passcode. Set up a step in your policy to set session.custom.last.username = session.logon.last.username after the login, but before the TFA. Do the same for password. When in your RDP profile under SSO, reference the session.custom.last.username and password.