# Remote desktop (RDP and VNC)

> Protect RDP and VNC access to servers and desktops with Just-in-Time sessions and full recording, and limit programs on Windows with AppLocker.

URL: https://docs.ironchip.com/en/pam/recursos/rdp/

This page explains how remote desktop access works with Ironchip PAM, over RDP and VNC. It is for whoever administers the machines and whoever connects to them.

## How it works

The person connects from the console (**Desktop** in **PAM > My access**) or with their remote desktop client. The Ironchip PAM broker receives the connection, holds it while Ironchip checks the window, the address and the factors, and then connects it to the desktop with the resource's credential, which the person does not know.

The whole screen is recorded, and the session can be watched live and ended instantly. See [Sessions and recordings](https://docs.ironchip.com/en/pam/administracion/sesiones/).

## RDP

- The broker needs a stored account to pass Network Level Authentication (NLA): **A stored password** or **Managed by Ironchip**, which is changed every day and after every session. See [Password rotation](https://docs.ironchip.com/en/pam/boveda/rotacion/).
- In **Sign-in**, you choose who signs in to Windows:
  - **The broker, as the account below**: everyone arrives already signed in as the resource's account.
  - **Each person, on the Windows sign-in screen**: the resource's account only opens the connection, and each person signs in with their own account on the Windows screen.
- With your own client, **Download .rdp** opens Remote Desktop on Windows, or Windows App on Mac, with the ticket already filled in.

## VNC

- VNC has no username: the recording is the only thing that ties the session to a person.
- The method is **Nothing (the server asks for nothing)** or **A stored password**. Most VNC servers only read the first eight characters of the password.

## Program control on Windows

With the [Ironchip agent](https://docs.ironchip.com/en/pam/administracion/agente/) installed, a [control policy](https://docs.ironchip.com/en/pam/administracion/politicas/#control-policies) decides which programs the account the broker signs in with can open. The rules are applied with AppLocker, by executable name even if the file is copied to another folder, or by path. The agent sets them before anyone connects and adjusts them while someone is connected.

The rules apply to the account the broker signs in with. If each person signs in on the Windows screen with their own account, or on VNC, there is no broker account to restrict.

## Steps

1. Register the machine as an RDP or VNC [resource](https://docs.ironchip.com/en/pam/administracion/recursos/) and add it to a [target policy](https://docs.ironchip.com/en/pam/administracion/politicas/#target-policies).
2. Name that policy in an [access](https://docs.ironchip.com/en/pam/administracion/accesos/).
3. (Optional) Install the [agent](https://docs.ironchip.com/en/pam/administracion/agente/) to limit programs and rotate the account's password.
4. The person [requests access](https://docs.ironchip.com/en/pam/usuarios/solicitar-acceso/), if needed, and [connects](https://docs.ironchip.com/en/pam/usuarios/conectarse/).