Did some tests, too.
No 1 should be easy to fix (I'm just not a GUI expert
No 3 is not as bad as it sounds in the first place:
It's exactly the same things you can do with e.g. 'net use'.
You can use 'whatever\username' if either
- there is an account 'username' in domain (or computer) 'whatever' OR
- there is an account 'username' somewhere and there is no domain or computer named 'whatever'.
I was able to reproduce this with a local account on the same machine the vnc server runs.
With a domain account, I got an error.
'Net use' with user and password specified shows exactly the same behavior, so I would like to call this a "Microsoft feature".
It's seems slightly more restrictive than using an unqualified name, so I don't see a security problem here.
No 2 could be a real showstopper.
I tested german umlauts (ä/ö/ü) in the password and got 'wrong password' messages.
I traced the code but could not find the error up to now.
Could be some ASCII-Unicode problem.