From 345abd782e66d50a1c04a95ad4dd9d7016f13264 Mon Sep 17 00:00:00 2001
From: hmo <staymo7777@gmail.com>
Date: Wed, 26 Aug 2026 02:48:32 +0800
Subject: [PATCH] =?UTF-8?q?fix(rdp):=20disable=20NLA=20by=20default=20in?=
 =?UTF-8?q?=20enable=20step=20=E2=80=94=20CredSSP=20pre-auth=20is=20the=20?=
 =?UTF-8?q?root=20cause=20of=20'stuck=20at=20configuring';=20tunnel=20is?=
 =?UTF-8?q?=20already=20SSH-encrypted?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 xmpp_agent_core.py | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/xmpp_agent_core.py b/xmpp_agent_core.py
index 056e411..53a2f8d 100644
--- a/xmpp_agent_core.py
+++ b/xmpp_agent_core.py
@@ -334,7 +334,8 @@ def _rdp_enable_run():
         _rdp_log(name, status, detail)
 
     try:
-        # Step 1: 开注册表
+        # Step 1: 开注册表（开RDP + 隧道场景统一关NLA——SSH已加密，NLA的CredSSP预认证
+        # 正是"卡正在配置远程电脑"的根源：连接到达TermService但NLA协商挂起、建不了会话）
         try:
             k = _wr.OpenKey(_wr.HKEY_LOCAL_MACHINE, r'SYSTEM\CurrentControlSet\Control\Terminal Server', 0, _wr.KEY_SET_VALUE)
             _wr.SetValueEx(k, 'fDenyTSConnections', 0, _wr.REG_DWORD, 0)
@@ -342,6 +343,13 @@ def _rdp_enable_run():
             mark('registry', 'ok', 'fDenyTSConnections=0')
         except Exception as e:
             mark('registry', 'fail', str(e))
+        try:
+            k2 = _wr.OpenKey(_wr.HKEY_LOCAL_MACHINE, r'SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp', 0, _wr.KEY_SET_VALUE)
+            _wr.SetValueEx(k2, 'UserAuthentication', 0, _wr.REG_DWORD, 0)
+            _wr.CloseKey(k2)
+            mark('registry', 'ok', 'NLA已关闭(UserAuthentication=0，隧道场景)')
+        except Exception as e:
+            mark('registry', 'warn', '关NLA失败: ' + str(e))
 
         # Step 2: 加入 RDP 用户组
         try: