为什么Windows 7/2008 mstsc在服务器证书警告之前要求输入用户名

http://technet.microsoft.com/en-us/library/cc749211%28WS.10%29.aspx

http://en.wikipedia.org/wiki/Network_Level_Authentication

基本上,回答你的问题……不,伪造的服务器不会损害你的凭据.他们必须做的第一件事就是将你的DNS欺骗到一个不正确的IP,但即使这样,RDP现在的工作方式(假设我们正在谈论Win7或Vista客户端和Win2008或更新的服务器)凭据是已加密且未公开(请注意在Technet文章底部解释的NTLM).

以下是Technet文章可能有所帮助的摘录：

Unlike the experience in Windows Server? 2003 Terminal Server,the credential prompt is on the client computer and not the server. Most importantly,the client credential prompt is on the secure desktop. Therefore,not even the Terminal Services client can see the credentials,which is an important Common Criteria requirement. Furthermore,the credentials obtained from the prompt will not be delegated until the server identity is authenticated (subject to policy configuration). Finally,the terminal server will not establish a session for the user (which consumes a significant amount of memory and CPU processing time on the server) before authenticating the client,which decreases the chances of successful denial-of-service attacks on the server.

编辑：让我们添加一个例子来澄清……

EXAMPLE #1 – USER HAS ACCESS TO REMOTE SERVER AND USES CORRECT
PASSWORD

在此示例中,您将输入用户名和密码,它将对域进行身份验证,以验证它是否为有效的用户名/密码,然后尝试连接到远程服务器.此时,如果它是第一个连接,您可能会得到“远程计算机的身份无法验证”,您可以选择信任与否.

EXAMPLE #2 – USER HAS ACCESS TO REMOTE SERVER AND USES INCORRECT
PASSWORD

在这里,您将看到您发布的图片…凭据不起作用.请输入新凭据.这是在客户端本地完成的(针对kerberos票证或DC进行验证),而无需连接到远程服务器.

EXAMPLE #3 – USER HAS NO ACCESS TO REMOTE SERVER BUT USES A CORRECT
USERNAME AND PASSWORD

在这里,您将在本地进行身份验证,因为它是一个有效的帐户和密码,但是一旦您连接到服务器以传递凭据,您将获得：

希望有帮助……