Remote Desktop (RDP)

RDP (Remote Desktop Protocol) is a protocol that allows communication between a terminal and a Windows server to run an application remotely. This guide protects RDP with Ironchip using RD Gateway and an NPS server protected by Ironchip.

Requirements

• A functional Active Directory.
• DHCP and DNS services active.
• RDP installed on the server.
• NPS protected by Ironchip. See Microsoft NPS.
• An HTTP-MFA integration (MFA application) created in Ironchip. See Create an HTTP-MFA integration.

Prepare the Windows environment

If you already have an Active Directory domain with DHCP and DNS, and RDP enabled on the server and on the clients, skip to Configure Ironchip. Otherwise, prepare the environment as follows.

Install Active Directory

1. In Server Manager, open Add Roles and Features and add these roles:

   • Active Directory Domain Services.
   • DHCP Server.
   • DNS Server.

2. Click Next until you reach the end. A progress bar appears.

3. Back on the main page of Server Manager, check that the three roles appear in the left menu. Two alerts also appear in the top menu.

4. Click the first alert, Promote this server to a domain controller.

5. Select Add a new forest and enter the domain name you want.

6. Follow the steps to the end and click Install. When it finishes, you get another alert about DNS, which you resolve later.

Configure DHCP

1. Click the second alert to apply the default configuration, and click Next until you reach the end.
2. Open DHCP from the administrative tools.
3. Right-click IPv4, select New Scope… and enter an IP range, for example 192.168.11.50 to 192.168.11.100. Leave the other settings at their defaults and click Finish.
4. Right-click the server name under DHCP and click Authorize. When you refresh the page, the IPv4 icon changes from red to green.

Configure DNS

Add a forwarder:

1. Open DNS from the administrative tools.
2. Right-click the server and select Properties.
3. On the Forwarders tab, add the external DNS servers you need, such as 8.8.8.8 and 8.8.4.4.

Enable RDP and join the client to the domain

Enable RDP on the server and on the client computer:

• Client computer: from Start, go to Developers settings and click Allow remote connections.
• Server, if the previous option does not work: in Server Manager, open Local Server. Among the properties you see Remote Desktop. Click Disabled, select Allow remote connections to this computer and click Apply. Then click Select Users… and choose the users who can access the server.

Note

If you have not created any user yet, create one first.

Then join the client computer to the domain:

1. Right-click This PC and, under Computer name, domain, and workgroup settings, click Change settings.
2. Enter the computer name and the domain it belongs to.
3. When the Active Directory sign-in appears, enter the Active Directory user and password.
4. Restart the computer and sign in with Other user, using the same username and password you entered in Active Directory.
5. Open an RDP connection with Remote Desktop Connection. It asks for the administrator credentials.

Configure Ironchip

1. In the admin console, create an application that references the HTTP-MFA integration. Set the External ID to the name of the RD CAP policy you configure in Windows (in this guide, IronchipCAP).

   

2. Add users to the application, using the format Domain\Username.

Create the Ironchip application and add users for RDPPlay video

Configure Windows

Install RD Gateway

1. In Server Manager, go to Remote Desktop Services.

   

2. Click the Remote Desktop Gateway button.

   

3. Select the server where you will install the service. On the next screen, enter the full domain name.

   

4. Click Next and then Add.

5. When the process finishes, Windows asks you to configure a certificate. This example uses a self-signed certificate.

   

6. If you do not have a certificate, click Create new certificate.

   

7. Enter the full domain name, a password, and a path to save the certificate, and check the box at the end. Click OK and then Apply.

   

8. Add the same certificate to all the services in the list by selecting the certificate.

Create or change the RD Gateway certificate

If RD Gateway is already installed, or you want to create the certificate later, do it from the manager:

1. In Tools, go to Remote Desktop Services and select Remote Desktop Gateway Manager.

   

2. Right-click the server, open Properties and go to the SSL Certificate tab.

   

3. Select Create a self-signed certificate, click Create and Import Certificate… and then OK. The certificate is saved in the Documents folder of the computer.

   

Install the certificate on the machines

Copy the certificate to all the machines, the server itself and the clients, and install it on each one with the same process:

1. Right-click the certificate.
2. Select Install Certificate.
3. Select Local Machine and click Next.
4. Select Place all certificates in the following store and click Browse….
5. In the window that opens, select the Trusted Root Certification Authorities folder and click OK.
6. Click Next and then Finish.

Create the RD CAP and RD RAP policies

1. In the Remote Desktop Gateway Manager, select your server and create a new policy by right-clicking Policies.

   

2. Select Create a RD CAP and a RD RAP.

   

3. Give the policy an identifying name. The name of the RD CAP policy (here, IronchipCAP) must match the External ID of the application you created in the Ironchip admin console.

   

4. Add the domain user groups the policy applies to: click Add Group…, then Advanced… and Find Now to see all the groups you can select.

   

5. On the next tab, select the first option and check the box at the end, Only allow client connections to Remote Desktop Session Host servers that enforce RD Gateway device redirection. The following options are not necessary: click Next until you reach the Resource Authorization Policy.

   

6. Give the resource authorization policy an identifying name.

   

7. Add the domain user groups the policy applies to, using the same procedure.

   

8. Select the last option, Allow users to connect to any network resource. The following option is not necessary: click Next until the configuration is complete.

   

Create the group policy

1. Open Group Policy Management, right-click your server, and select Create a GPO in this domain, and Link it here.

   

2. Enter a name, for example Ironchip.

3. Right-click the GPO you created and select Edit.

4. In the Group Policy Management Editor, go to User Configuration > Policies > Administrative Templates > Windows Components > Remote Desktop Services > RD Gateway.

   

5. Select Set RD Gateway authentication method, enable it by clicking Enabled, and select Ask for credentials, use Negotiate protocol.

   

6. Select Enable connection through RD Gateway and enable it by clicking Enabled.

7. Select Set RD Gateway server address, enable it by clicking Enabled, and enter the address of your server, for example 10.0.0.2.

8. Run gpupdate in PowerShell on all related machines.

Add the policies to the plugin

If you have not installed the NPS plugin yet, follow Install the NPS plugin. Then add the policies you created to the plugin:

1. Run the plugin installer again and click Change.

2. In NPS Policies, add the network policy protected by Ironchip and the RD CAP, separated by commas.

   

3. Restart the NPS and RDP services.

Verify the integration

You need a client computer connected to the domain. Follow the steps in the video.

Check RDP access protected with IronchipPlay video

Video tutorial

Full RDP with Ironchip tutorialPlay video

Allow RDP only through Gateway

Configure the server firewall so that it only accepts RDP connections through the gateway.

1. Open Windows Defender Firewall with Advanced Security.

   

2. Go to Inbound Rules and find Remote Desktop - User Mode (TCP Inbound) and Remote Desktop - User Mode (UDP Inbound).

   

3. Open the TCP rule. Both configurations are exactly the same:

   1. On the General tab, select Block the connection.
   2. On the Scope tab, add your server’s IP under Local IP address.
   3. Apply the changes.

   

   

4. Repeat the previous steps with the UDP rule.