Overview
Starting with Windows 11 version 24H2 and Windows Server 2025, Microsoft has disabled Multiple Provider Router (MPR) notifications by default. This change affects environments with the Parallels RAS with Single Sign-On (SSO) component installed, potentially preventing user credentials from being retrieved locally during login.
Affected Environments
This article applies only to environments where the Parallels RAS SSO component is installed and in use for the scenarios described below.
- Parallels RAS Console running on Windows Server 2025 or Windows 11 24H2 with Parallels RAS SSO component installed and SSO set as the authentication type using local credentials.
- Parallels RAS Client for Windows running on Windows Server 2025 or Windows 11 24H2 with Parallels RAS SSO component installed and SSO set as the authentication type using local credentials.
Note:
- SSO using SAML (Security Assertion Markup Language) is not affected.
- Authentication type Web is not affected.
Symptoms
When logging into a machine running Windows 11 24H2 or Windows Server 2025 with Parallels RAS Console or Parallels RAS Client for Windows and SSO enabled, the following issues may occur:
- In Parallels RAS Console, administrators cannot use SSO as the authentication type. An error message appears stating that the username or password is incorrect. However, using Credentials as the authentication type works as expected.
- In Parallels RAS Client for Windows, the Single Sign-On option is missing from the Authentication type dropdown in the connection properties.
Cause
The issue is caused by a change in Windows 11 24H2 and Windows Server 2025, where MPR notifications are disabled by default. These notifications are required to transmit the user's password context during login, which is essential for SSO functionality in Parallels RAS.
Resolution
To restore SSO functionality, enable the following Group Policy setting on affected machines:
Computer Configuration > Administrative Templates > Windows Components > Windows Logon Options > Configure the transmission of the user's password in the content of MPR notifications sent by winlogon
Action: Set the policy to Enabled
Alternative: Registry Configuration
You can also enable this setting via the Windows Registry:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
Key:
"EnableMPR"=dword:00000001
Important: After applying the policy or registry change, restart the machine to ensure the setting takes effect.
Additional Information
Parallels is actively investigating solutions to enable SSO functionality without relying on MPR notifications.
For more information about MPR notifications and configuration, refer to the official Microsoft documentation here.
Was this article helpful?
Tell us how we can improve it.