Hello Brian,
by default the html5 client uses highest available security authentication level NLA(CredSPP NTLMv2/v1) despite of server settings.
But, on server side Microsoft's RDP server offers 3 options.
1. Disable RDP
2. Compatibility mode, (client oriented or server oriented)
3. NLA level clients only.
If you enable Option 3. than you will never get "both show the windows error as my users prefer", you will always get authentication error by wrong user/pass, same like mstsc.exe
If you enable Option 2. than there are 2 known behaviours.
Behaviour 2.1 - client oriented - if client supports NLA, but login or pass does not match, you will get NLA - wrong credentials, because server does not throw error about no-NLA support. But if client does not support NLA anyway, because first request is of RDP auth level type, than you get "windows error".
Behaviour 2.2 - server oriented - despite of fact, if client supports NLA or not, on NLA request server responses with error command, according to this command the client switches to RDP auth level and on second connection it will authenticate on- RDP level and than by wrong login/pass you get "windows error".
I assume, your server N2 uses type 2.1 client oriented, therefore on wrong login/pass you get this NLA message.
If you ask me, on what exactly it depends, I have no answer for you, why there is client or server behaviour for compatibility mode. I noticed, on older systems it uses always server oriented way, but on new systems it seems to depend on installed patches, same Windows system on different machines may show different behaviours, server or client oriented, seems really to depend on latest patches.
Now to final question, how to enforce client to use always RDP level authentication and not NLA to get your "windows error".
1. First of all go sure you use setting on server >> 2. Compatibility mode, (client oriented or server oriented)
2. Next locate, TSplus\Clients\webserver
3. and create there file settings.bin (TSplus\Clients\webserver\settings.bin) with following content
enabled_rdp_credssp=false
4. Now open GUI and restart server to take changes effect.
(you can check, if option is in effect by looking inside weblog.txt in same directory, it should contain "Disabled RDP CredSPP only", also at least it will still use SSL tunnel for connection).
From now the client will always use RDP level only and so you will get your "windows error".
Remember, disabled NLA lowers security level, and if you ask, if it is possible to force Microsoft RDP server to use NLA and by wrong login or pass to show their "windows error", the answer is NO, it acts like mstsc.exe in this manner, that is why NLA is higher level, login and pass has to be provided before connection, not after, so you fail already on network level.
