# Remote Desktop (RDP)

> Protect Windows Remote Desktop with Ironchip: set up RD Gateway, the RD CAP and RD RAP policies, the NPS plugin, and restrict RDP to Gateway-only access.

URL: https://docs.ironchip.com/en/identidad/integraciones/puestos/rdp/

RDP (Remote Desktop Protocol) is a protocol that allows communication between a terminal and a Windows server to run an application remotely. This guide protects RDP with Ironchip using RD Gateway and an NPS server protected by Ironchip.

## Requirements

- A functional Active Directory.
- DHCP and DNS services active.
- RDP installed on the server.
- NPS protected by Ironchip. See [Microsoft NPS](https://docs.ironchip.com/en/identidad/integraciones/red/nps/).
- An HTTP-MFA integration (MFA application) created in Ironchip. See [Create an HTTP-MFA integration](https://docs.ironchip.com/en/identidad/administracion/aplicaciones/#create-an-http-mfa-integration).

## Prepare the Windows environment

If you already have an Active Directory domain with DHCP and DNS, and RDP enabled on the server and on the clients, skip to [Configure Ironchip](#configure-ironchip). Otherwise, prepare the environment as follows.

### Install Active Directory

1. In **Server Manager**, open **Add Roles and Features** and add these roles:

   - Active Directory Domain Services.
   - DHCP Server.
   - DNS Server.

2. Click **Next** until you reach the end. A progress bar appears.
3. Back on the main page of Server Manager, check that the three roles appear in the left menu. Two alerts also appear in the top menu.
4. Click the first alert, **Promote this server to a domain controller**.
5. Select **Add a new forest** and enter the domain name you want.
6. Follow the steps to the end and click **Install**. When it finishes, you get another alert about DNS, which you resolve later.

### Configure DHCP

1. Click the second alert to apply the default configuration, and click **Next** until you reach the end.
2. Open DHCP from the administrative tools.
3. Right-click **IPv4**, select **New Scope...** and enter an IP range, for example `192.168.11.50` to `192.168.11.100`. Leave the other settings at their defaults and click **Finish**.
4. Right-click the server name under DHCP and click **Authorize**. When you refresh the page, the IPv4 icon changes from red to green.

### Configure DNS

Add a forwarder:

1. Open DNS from the administrative tools.
2. Right-click the server and select **Properties**.
3. On the **Forwarders** tab, add the external DNS servers you need, such as `8.8.8.8` and `8.8.4.4`.

### Enable RDP and join the client to the domain

Enable RDP on the server and on the client computer:

- **Client computer**: from Start, go to **Developers settings** and click **Allow remote connections**.
- **Server**, if the previous option does not work: in Server Manager, open **Local Server**. Among the properties you see **Remote Desktop**. Click **Disabled**, select **Allow remote connections to this computer** and click **Apply**. Then click **Select Users...** and choose the users who can access the server.

:::note
If you have not created any user yet, create one first.
:::

Then join the client computer to the domain:

1. Right-click **This PC** and, under **Computer name, domain, and workgroup settings**, click **Change settings**.
2. Enter the computer name and the domain it belongs to.
3. When the Active Directory sign-in appears, enter the Active Directory user and password.
4. Restart the computer and sign in with **Other user**, using the same username and password you entered in Active Directory.
5. Open an RDP connection with **Remote Desktop Connection**. It asks for the administrator credentials.

## Configure Ironchip

1. In the admin console, create an application that references the HTTP-MFA integration. Set the **External ID** to the name of the RD CAP policy you configure in Windows (in this guide, `IronchipCAP`).

   [Image: Ironchip application with the External ID matching the RD CAP name]

2. Add users to the application, using the format `Domain\Username`.

Video: [Create the Ironchip application and add users for RDP](https://play.hubspotvideo.com/v/7745202/id/146247089531)

## Configure Windows

### Install RD Gateway

1. In Server Manager, go to **Remote Desktop Services**.

   [Image: Remote Desktop Services in Server Manager]

2. Click the **Remote Desktop Gateway** button.

   [Image: Remote Desktop Gateway button]

3. Select the server where you will install the service. On the next screen, enter the full domain name.

   [Image: Server selection and full domain name]

4. Click **Next** and then **Add**.
5. When the process finishes, Windows asks you to configure a certificate. This example uses a self-signed certificate.

   [Image: Certificate configuration for RD Gateway]

6. If you do not have a certificate, click **Create new certificate**.

   [Image: Create new certificate option]

7. Enter the full domain name, a password, and a path to save the certificate, and check the box at the end. Click **OK** and then **Apply**.

   [Image: Certificate creation form]

8. Add the same certificate to all the services in the list by selecting the certificate.

### Create or change the RD Gateway certificate

If RD Gateway is already installed, or you want to create the certificate later, do it from the manager:

1. In **Tools**, go to **Remote Desktop Services** and select **Remote Desktop Gateway Manager**.

   [Image: Tools menu with Remote Desktop Gateway Manager]

2. Right-click the server, open **Properties** and go to the **SSL Certificate** tab.

   [Image: SSL Certificate tab of the server properties]

3. Select **Create a self-signed certificate**, click **Create and Import Certificate...** and then **OK**. The certificate is saved in the **Documents** folder of the computer.

   [Image: Option to create a self-signed certificate]

### Install the certificate on the machines

Copy the certificate to all the machines, the server itself and the clients, and install it on each one with the same process:

1. Right-click the certificate.
2. Select **Install Certificate**.
3. Select **Local Machine** and click **Next**.
4. Select **Place all certificates in the following store** and click **Browse…**.
5. In the window that opens, select the **Trusted Root Certification Authorities** folder and click **OK**.
6. Click **Next** and then **Finish**.

### Create the RD CAP and RD RAP policies

1. In the Remote Desktop Gateway Manager, select your server and create a new policy by right-clicking **Policies**.

   [Image: Context menu to create a new policy]

2. Select **Create a RD CAP and a RD RAP**.

   [Image: Wizard with the option to create RD CAP and RD RAP]

3. Give the policy an identifying name. The name of the RD CAP policy (here, `IronchipCAP`) must match the **External ID** of the application you created in the Ironchip admin console.

   [Image: Name of the RD CAP policy]

4. Add the domain user groups the policy applies to: click **Add Group...**, then **Advanced...** and **Find Now** to see all the groups you can select.

   [Image: User groups for the RD CAP policy]

5. On the next tab, select the first option and check the box at the end, **Only allow client connections to Remote Desktop Session Host servers that enforce RD Gateway device redirection**. The following options are not necessary: click **Next** until you reach the Resource Authorization Policy.

   [Image: RD CAP policy options]

6. Give the resource authorization policy an identifying name.

   [Image: Name of the resource authorization policy]

7. Add the domain user groups the policy applies to, using the same procedure.

   [Image: User groups for the RD RAP policy]

8. Select the last option, **Allow users to connect to any network resource**. The following option is not necessary: click **Next** until the configuration is complete.

   [Image: Option to allow connection to any network resource]

### Create the group policy

1. Open **Group Policy Management**, right-click your server, and select **Create a GPO in this domain, and Link it here**.

   [Image: Context menu to create and link a GPO]

2. Enter a name, for example `Ironchip`.
3. Right-click the GPO you created and select **Edit**.
4. In the Group Policy Management Editor, go to **User Configuration > Policies > Administrative Templates > Windows Components > Remote Desktop Services > RD Gateway**.

   [Image: Path to RD Gateway in the GPO editor]

5. Select **Set RD Gateway authentication method**, enable it by clicking **Enabled**, and select **Ask for credentials, use Negotiate protocol**.

   [Image: RD Gateway authentication method enabled]

6. Select **Enable connection through RD Gateway** and enable it by clicking **Enabled**.
7. Select **Set RD Gateway server address**, enable it by clicking **Enabled**, and enter the address of your server, for example `10.0.0.2`.
8. Run `gpupdate` in PowerShell on all related machines.

### Add the policies to the plugin

If you have not installed the NPS plugin yet, follow [Install the NPS plugin](https://docs.ironchip.com/en/identidad/integraciones/red/nps/#install-the-nps-plugin). Then add the policies you created to the plugin:

1. Run the plugin installer again and click **Change**.
2. In **NPS Policies**, add the network policy protected by Ironchip and the RD CAP, separated by commas.

   [Image: NPS plugin installer with several policies in the NPS Policies field]

3. Restart the NPS and RDP services.

## Verify the integration

You need a client computer connected to the domain. Follow the steps in the video.

Video: [Check RDP access protected with Ironchip](https://play.hubspotvideo.com/v/7745202/id/146253094929)

### Video tutorial

Video: [Full RDP with Ironchip tutorial](https://play.hubspotvideo.com/v/7745202/id/146254530680)

## Allow RDP only through Gateway

Configure the server firewall so that it only accepts RDP connections through the gateway.

1. Open **Windows Defender Firewall with Advanced Security**.

   [Image: Windows Defender Firewall with Advanced Security]

2. Go to **Inbound Rules** and find **Remote Desktop - User Mode (TCP Inbound)** and **Remote Desktop - User Mode (UDP Inbound)**.

   [Image: Remote Desktop user mode inbound rules]

3. Open the TCP rule. Both configurations are exactly the same:

   1. On the **General** tab, select **Block the connection**.
   2. On the **Scope** tab, add your server's IP under **Local IP address**.
   3. Apply the changes.

   [Image: General tab with Block the connection]

   [Image: Scope tab with the server local IP]

4. Repeat the previous steps with the UDP rule.