Remote desktop (RDP and VNC)

This page explains how remote desktop access works with Ironchip PAM, over RDP and VNC. It is for whoever administers the machines and whoever connects to them.

How it works

The person connects from the console (Desktop in PAM > My access) or with their remote desktop client. The Ironchip PAM broker receives the connection, holds it while Ironchip checks the window, the address and the factors, and then connects it to the desktop with the resource’s credential, which the person does not know.

The whole screen is recorded, and the session can be watched live and ended instantly. See Sessions and recordings.

RDP

• The broker needs a stored account to pass Network Level Authentication (NLA): A stored password or Managed by Ironchip, which is changed every day and after every session. See Password rotation.
• In Sign-in, you choose who signs in to Windows:
  • The broker, as the account below: everyone arrives already signed in as the resource’s account.
  • Each person, on the Windows sign-in screen: the resource’s account only opens the connection, and each person signs in with their own account on the Windows screen.
• With your own client, Download .rdp opens Remote Desktop on Windows, or Windows App on Mac, with the ticket already filled in.

VNC

• VNC has no username: the recording is the only thing that ties the session to a person.
• The method is Nothing (the server asks for nothing) or A stored password. Most VNC servers only read the first eight characters of the password.

Program control on Windows

With the Ironchip agent installed, a control policy decides which programs the account the broker signs in with can open. The rules are applied with AppLocker, by executable name even if the file is copied to another folder, or by path. The agent sets them before anyone connects and adjusts them while someone is connected.

The rules apply to the account the broker signs in with. If each person signs in on the Windows screen with their own account, or on VNC, there is no broker account to restrict.

Steps

1. Register the machine as an RDP or VNC resource and add it to a target policy.
2. Name that policy in an access.
3. (Optional) Install the agent to limit programs and rotate the account’s password.
4. The person requests access, if needed, and connects.