Remote Desktop Gateway Manager

Remote Desktop Gateway

Remote Desktop Gateway (RD Gateway) is a role service that enables authorized remote users to connect to resources on an internal corporate or private network, from any Internet-connected device that can run the Remote Desktop Connection (RDC) client. The network resources can be Remote Desktop Session Host (RD Session Host) servers, RD Session Host servers running RemoteApp programs, or computers with Remote Desktop enabled.

RD Gateway uses the Remote Desktop Protocol (RDP) over HTTPS to establish a secure, encrypted connection between remote users on the Internet and the internal network resources on which their productivity applications run.

The following topics are covered:

  • Overview of Remote Desktop Gateway

  • Checklist: Configure Remote Desktop Gateway

  • Remote Desktop Gateway Installation Prerequisites

  • Configuring the Remote Desktop Gateway Server

  • Configuring the Remote Desktop Services Client for Remote Desktop Gateway

  • Using Group Policy to Manage Client Connections Through Remote Desktop Gateway

  • Monitoring a Remote Desktop Gateway Server for Connection Status and Reporting

  • Enable or Disable Credential Sharing for Connections Through Remote Desktop Gateway


Overview of Remote Desktop Gateway

What is Remote Desktop Gateway?

Remote Desktop Gateway (RD Gateway) is a role service that enables authorized remote users to connect to resources on an internal corporate or private network, from any Internet-connected device that can run the Remote Desktop Connection (RDC) client. The network resources can be Remote Desktop Session Host (RD Session Host) servers, RD Session Host servers running RemoteApp programs, or computers with Remote Desktop enabled.

RD Gateway uses the Remote Desktop Protocol (RDP) over HTTPS to establish a secure, encrypted connection between remote users on the Internet and the internal network resources on which their productivity applications run.

Why use Remote Desktop Gateway?

RD Gateway provides many benefits, including:

  • RD Gateway enables remote users to connect to internal network resources over the Internet, by using an encrypted connection, without needing to configure virtual private network (VPN) connections.

  • RD Gateway provides a comprehensive security configuration model that enables you to control access to specific internal network resources. RD Gateway provides a point-to-point RDP connection, rather than allowing remote users access to all internal network resources.

  • RD Gateway enables most remote users to connect to internal network resources that are hosted behind firewalls in private networks and across network address translators (NATs). With RD Gateway, you do not need to perform additional configuration for the RD Gateway server or clients for this scenario.

    Prior to this release of Windows Server, security measures prevented remote users from connecting to internal network resources across firewalls and NATs. This is because port 3389, the port used for RDP connections, is typically blocked for network security purposes. RD Gateway transmits RDP traffic to port 443 instead, by using an HTTP Secure Sockets Layer/Transport Layer Security (SSL/TLS) tunnel. Because most corporations open port 443 to enable Internet connectivity, RD Gateway takes advantage of this network design to provide remote access connectivity across multiple firewalls.

  • The Remote Desktop Gateway Manager enables you to configure authorization policies to define conditions that must be met for remote users to connect to internal network resources. For example, you can specify:

    • Who can connect to internal network resources (in other words, the user groups who can connect).

    • What network resources (computer groups) users can connect to.

    • Whether client computers must be members of Active Directory security groups.

    • Whether device redirection is allowed.

    • Whether clients need to use smart card authentication or password authentication, or whether they can use either method.

  • You can configure RD Gateway servers and Remote Desktop Services clients to use Network Access Protection (NAP) to further enhance security. NAP is a health policy creation, enforcement, and remediation technology that is included in Windows Server® 2008 R2, Windows Server® 2008, Windows® 7, Windows Vista®, and Windows® XP Service Pack 3. With NAP, system administrators can enforce health requirements, which can include software requirements, security update requirements, required computer configurations, and other settings.

    Note

    Computers running Windows Server 2008 R2 or Windows Server 2008 cannot be used as NAP clients when RD Gateway enforces NAP. Only computers running Windows 7, Windows Vista, or Windows XP SP3 can be used as NAP clients when RD Gateway enforces NAP.

    For information about how to configure RD Gateway to use NAP for health policy enforcement for Remote Desktop Services clients that connect to RD Gateway servers, see the Remote Desktop Services page on the Windows Server 2008 R2 TechCenter (http://go.microsoft.com/fwlink/?linkid=140433).

  • You can use RD Gateway server with Microsoft Internet Security and Acceleration (ISA) Server to enhance security. In this scenario, you can host RD Gateway servers in a private network rather than a perimeter network, and host ISA Server in the perimeter network. The Secure Sockets Layer (SSL) connection between the Remote Desktop Services client and ISA Server can be terminated at the ISA Server, which is Internet-facing.

    For information about how to configure ISA Server as an SSL termination device for RD Gateway server scenarios, see the Remote Desktop Services page on the Windows Server 2008 R2 TechCenter (http://go.microsoft.com/fwlink/?linkid=140433).

  • Remote Desktop Gateway Manager provides tools to help you monitor RD Gateway server status and events. By using Remote Desktop Gateway Manager, you can specify events (such as unsuccessful connection attempts to the RD Gateway server) that you want to monitor for auditing purposes.

Additional references

  • Remote Desktop Gateway Manager


Checklist: Configure Remote Desktop Gateway

This checklist lists the tasks that you need to complete to successfully configure RD Gateway for the RD Gateway core scenario. This scenario enables you to configure an RD Gateway server so that a remote user can access an internal corporate or private network resource over the Internet, through the RD Gateway server. In this scenario, an internal network resource can be a Remote Desktop Session Host (RD Session Host) server, an RD Session Host server running RemoteApp programs, or a computer with Remote Desktop enabled.

Task | Reference
Install the Remote Desktop Gateway role service. | Install the Remote Desktop Gateway Role Service
Obtain a certificate for the RD Gateway server. | Obtain a Certificate for the Remote Desktop Gateway Server
Create a Remote Desktop connection authorization policy (RD CAP). | Create an RD CAP
Create a Remote Desktop resource authorization policy (RD RAP). | Create an RD RAP
Configure the Remote Desktop Services client for RD Gateway. | Configuring the Remote Desktop Services Client for Remote Desktop Gateway

For more information about RD Gateway, see the Remote Desktop Services page on the Windows Server 2008 R2 TechCenter (http://go.microsoft.com/fwlink/?LinkId=140433).


Remote Desktop Gateway Installation Prerequisites

For RD Gateway to function correctly, you must meet these prerequisites:

  • You must have a server with Windows Server 2008 R2 installed.

  • Membership in the local Administrators group, or equivalent, on the RD Gateway server that you plan to configure, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

  • You must obtain a Secure Sockets Layer (SSL) certificate for the RD Gateway server if you do not have one already. By default, on the RD Gateway server, the Internet Information Services (IIS) service uses Transport Layer Security (TLS) 1.0 to encrypt communications between clients and RD Gateway servers over the Internet. For TLS to function correctly, you must install an SSL certificate on the RD Gateway server.

    Note

    You do not need a certification authority (CA) infrastructure within your organization if you can use another method to obtain an externally trusted certificate that meets the requirements for RD Gateway. If your company does not maintain a stand-alone CA or an enterprise CA and you do not have a compatible certificate from a trusted public CA, you can create and import a self-signed certificate for your RD Gateway server for technical evaluation and testing purposes. For more information, see Create a Self-Signed Certificate for the Remote Desktop Gateway Server.

    For information about certificate requirements for RD Gateway and how to obtain and install a certificate, see Obtain a Certificate for the Remote Desktop Gateway Server.

  • If you configure an RD Gateway authorization policy that requires that users on client computers be members of an Active Directory security group to connect to the RD Gateway servers, the RD Gateway servers must also be members of an Active Directory domain.

Role, role service, and feature dependencies

To function correctly, RD Gateway requires several role services and features to be installed and running. When you use Server Manager to install the RD Gateway role service, the following additional roles, role services, and features are automatically installed and started, if they are not already installed:

  • Remote procedure call (RPC) over HTTP Proxy

  • Web Server (IIS) [Internet Information Services]

    IIS must be installed and running for the RPC over HTTP Proxy feature to function.

  • Network Policy and Access Services

    You can also configure RD Gateway to use Remote Desktop connection authorization policies (RD CAPs) that are stored on another server that runs the Network Policy Server (NPS) service. By doing this, you are using the server running NPS, formerly known as a Remote Authentication Dial-In User Service (RADIUS) server, to centralize the storage, management, and validation of RD CAPs. If you have already deployed a server running NPS for remote access scenarios such as VPN and dial-up networking, using the existing server running NPS for RD Gateway scenarios as well can enhance your deployment.

Additional references

  • Remote Desktop Gateway Manager


Configuring the Remote Desktop Gateway Server

This section provides procedures for installing RD Gateway and configuring authorization policies to define conditions that users must meet to connect to internal network resources (computers) through RD Gateway. In addition, procedures are included for specifying the users who can access internal network computers and the computers that they can access. The following topics are covered:

  • Install the Remote Desktop Gateway Role Service

  • Open the Remote Desktop Gateway Manager

  • Configure a Certificate for the Remote Desktop Gateway Server

  • Specify a Remote Desktop Gateway Server to Manage

  • Create a Remote Desktop Gateway Server Farm

  • Remove Members of a Remote Desktop Gateway Server Farm

  • Disable Management for a Remote Desktop Gateway Server

  • Understanding Authorization Policies for Remote Desktop Gateway

  • Manage Remote Desktop Connection Authorization Policies (RD CAPs)

  • Manage Remote Desktop Resource Authorization Policies (RD RAPs)

  • Enable SSL Bridging on the Remote Desktop Gateway Server

  • Enable NAP Health Policy Checking on the Remote Desktop Gateway Server

  • Limit the Maximum Number of Simultaneous Connections Through a Remote Desktop Gateway Server

  • Import or Export Settings for a Remote Desktop Gateway Server

  • Configure Messaging for a Remote Desktop Gateway Server


Install the Remote Desktop Gateway Role Service

Membership in the local Administrators group, or equivalent, on the RD Gateway server that you plan to configure, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To install the Remote Desktop Gateway role service

  1. Open Server Manager. To open Server Manager, click Start, point to Administrative Tools, and then click Server Manager.

  2. If the Remote Desktop Services role is not already installed:

    1. In Server Manager, under Roles Summary, click Add Roles.

    2. In the Add Roles Wizard, if the Before You Begin page appears, click Next. This page will not appear if you have already installed other roles and you have selected the Skip this page by default check box.

    3. On the Select Server Roles page, under Roles, select Remote Desktop Services, and then click Next.

    4. On the Remote Desktop Services page, click Next.

    5. On the Select Role Services page, select the Remote Desktop Gateway check box.

    6. If prompted to specify whether you want to install the additional role services required for Remote Desktop Gateway, click Add Required Role Services.

    7. On the Select Role Services page, click Next.

    If the Remote Desktop Services role is already installed:

    1. Under Roles Summary, click Remote Desktop Services.

    2. Under Role Services, click Add Role Services.

    3. On the Select Role Services page, select the Remote Desktop Gateway check box, and then click Next.

    4. If prompted to specify whether you want to install the additional role services required for Remote Desktop Gateway, click Add Required Role Services.

    5. On the Select Role Services page, click Next.

  3. On the Choose a Server Authentication Certificate for SSL Encryption page, specify whether to choose an existing certificate for SSL encryption (recommended), create a self-signed certificate for SSL encryption, or choose a certificate for SSL encryption later. If you are completing an installation for a new server that does not yet have certificates, see Obtain a Certificate for the Remote Desktop Gateway Server for certificate requirements and information about how to obtain and install a certificate.

    Under the Choose an existing certificate for SSL encryption (recommended) option, only certificates that have the intended purpose (server authentication) and Enhanced Key Usage (EKU) [Server Authentication (1.3.6.1.5.5.7.3.1)] that are appropriate for the RD Gateway role service will appear in the list of certificates. If you select this option, click Import, and then import a new certificate. A certificate that does not meet these requirements will not appear in the list.

  4. On the Create Authorization Policies for RD Gateway page, specify whether you want to create authorization policies (an RD CAP and an RD RAP) during the Remote Desktop Gateway role service installation process or later. If you select Later, follow the procedures in Create an RD CAP to create this policy. If you select Now, do the following:

    1. On the Select User Groups That Can Connect Through RD Gateway page, click Add to specify additional user groups. In the Select Groups dialog box, specify the user group location and name, and then click OK as needed to check the name and to close the Select Groups dialog box.

      To specify more than one user group, do either of the following: Type the name of each user group, separating the name of each group with a semi-colon; or add additional groups from different domains by repeating the first part of this step for each group.

    2. After you finish specifying additional user groups, on the Select User Groups That Can Connect Through RD Gateway page, click Next.

    3. On the Create an RD CAP for RD Gateway page, accept the default name for the RD CAP (RD_CAP_01) or specify a new name, select one or more supported Windows authentication methods, and then click Next.

    4. On the Create an RD RAP for RD Gateway page, accept the default name for the RD RAP (RD_RAP_01) or specify a new name, and then do one of the following: Specify whether to allow users to connect only to computers in one or more computer groups, and then specify the computer group; or specify that users can connect to any computer on the network. Click Next.

  5. On the Network Policy and Access Services page (which appears if this role service is not already installed), review the summary information, and then click Next.

  6. On the Select Role Services page, verify that Network Policy Server is selected, and then click Next.

  7. On the Web Server (IIS) page (which appears if this role service is not already installed), review the summary information, and then click Next.

  8. On the Select Role Services page, accept the default selections for Web Server (IIS), and then click Next.

  9. On the Confirm Installation Selections page, verify that the following role services will be installed:

    • Remote Desktop Services\RD Gateway

    • Network Policy and Access Services\Network Policy Server

    • Web Server (IIS)

    • RPC over HTTP Proxy

  10. Click Install.

  11. On the Installation Progress page, installation progress will be noted.

    If any of these roles, role services, or features has already been installed, installation progress will be noted only for the new roles, role services, or features that are being installed.

  12. On the Installation Results page, confirm that installation for these roles, role services, and features was successful, and then click Close.

Additional references

  • Configuring the Remote Desktop Gateway Server

  • Checklist: Configure Remote Desktop Gateway


Open the Remote Desktop Gateway Manager

To open the Remote Desktop Gateway Manager from the start menu

  • Click Start, point to Administrative Tools, point to Remote Desktop Services, and then click Remote Desktop Gateway Manager.

  • Click Start, click Run, type tsgateway.msc and then press ENTER.

To open the Remote Desktop Gateway Manager from Server Manager

  1. Click Start, point to Administrative Tools, and then click Server Manager.

  2. In the left pane, expand Roles.

  3. Expand Remote Desktop Services, and then click RD Gateway Manager.

To run Remote Desktop Gateway Manager from the Microsoft Management Console

  1. Click Start, click Run, type mmc and then press ENTER.

  2. On the File menu, click Add/Remove Snap-in.

  3. Under Available snap-ins, click Remote Desktop Gateway Manager, and then click Add.

  4. Click OK.
Additional references
  • Configuring the Remote Desktop Gateway Server

  • Checklist: Configure Remote Desktop Gateway


Configure a Certificate for the Remote Desktop Gateway Server

By default, Transport Layer Security (TLS) 1.0 is used to encrypt communications between Remote Desktop Services clients and RD Gateway servers over the Internet. For TLS to function correctly, you must install a Secure Sockets Layer-compatible X.509 certificate on the RD Gateway server.

You can obtain a certificate in one of the following ways:

  • You can generate and submit a certificate request to obtain a certificate from a stand-alone or an enterprise certification authority (CA).

  • You can purchase a certificate (or obtain one at no cost on a trial basis) from one of the trusted public CAs that participate in the Microsoft Root Certificate Program Members program [as listed in article 931125 in the Microsoft Knowledge Base (http://go.microsoft.com/fwlink/?LinkID=59547)].

  • You can use the Add Roles Wizard to create a self-signed certificate when you install the RD Gateway role service, or you can use Remote Desktop Gateway Manager to do this after RD Gateway is installed.

Note

We recommend that you use a self-signed certificate only for testing and evaluation purposes.

For more information about RD Gateway, see the Remote Desktop Services page on the Windows Server 2008 R2 TechCenter (http://go.microsoft.com/fwlink/?LinkId=140433).

This section describes certificate requirements for the RD Gateway server and provides more information about the different methods that you can use to obtain a certificate. The following topics are covered:

  • Obtain a Certificate for the Remote Desktop Gateway Server

  • Create a Self-Signed Certificate for the Remote Desktop Gateway Server

  • Select an Existing Certificate for Remote Desktop Gateway

  • Import a Certificate into Remote Desktop Gateway Server

  • View or Modify Certificate Properties


Obtain a Certificate for the Remote Desktop Gateway Server

This topic assumes an understanding of certificate trust chaining, certificate signing, and general public key infrastructure and certificate configuration principles. For information about PKI configuration in Windows Server 2008, see ITPROADD-204: PKI Enhancement in Windows Vista and Windows Server 2008 (http://go.microsoft.com/fwlink/?LinkId=93995). For information about PKI configuration in Windows Server 2003, see Public Key Infrastructure (http://go.microsoft.com/fwlink/?LinkID=54917).

By default, Transport Layer Security (TLS) 1.0 is used to encrypt communications between Remote Desktop Services clients and RD Gateway servers over the Internet. TLS is a standard protocol that is used to provide secure Web communications on the Internet or intranets. TLS is the latest and most secure version of the Secure Sockets Layer (SSL) protocol. For more information about TLS, see:

  • SSL/TLS in Windows Server 2003 (http://go.microsoft.com/fwlink/?LinkID=19646)

  • RFC 2246, The TLS Protocol Version 1.0 (http://go.microsoft.com/fwlink/?LinkID=40979)

For TLS to function correctly, you must install an SSL-compatible X.509 certificate on the RD Gateway server.

Certificate installation and configuration process overview

The process of obtaining, installing, and configuring a certificate for the RD Gateway server involves these steps.

Step 1: Obtain a certificate for the Remote Desktop Gateway server

You can obtain a certificate for the RD Gateway server by using one of the following methods:

  • If your company maintains a stand-alone or enterprise CA that is configured to issue SSL-compatible X.509 certificates that meet RD Gateway requirements, you can generate and submit a certificate request in several ways, depending on the policies and configuration of your organization's CA. Methods for obtaining a certificate include:

    • Initiating auto-enrollment from the Certificates snap-in.

    • Requesting certificates by using the Certificate Request Wizard.

    • Requesting a certificate over the Web.

      Note

      If you have a Windows Server 2003 CA, be aware that the Windows Server 2003 Certificate Services Web enrollment functionality relies on an ActiveX control that is named Xenroll. This ActiveX control is available in Microsoft Windows Server 2003, Windows 2000, and Windows XP. However, Xenroll has been deprecated in Windows Server 2008 and Windows Vista. The sample certificate enrollment Web pages that are included with the original release version of Windows Server 2003, Windows Server 2003 Service Pack 1 (SP1), and Windows Server 2003 Service Pack 2 (SP2) are not designed to handle the change in how Windows Server 2008 and Windows Vista perform Web-based certificate enrollment operations. For information about the steps that you can take to address this issue, see article 922706 in the Microsoft Knowledge Base (http://go.microsoft.com/fwlink/?LinkId=94472).

    • Using the Certreq command-line tool.

    For more information about using any of these methods to obtain certificates for Windows Server 2008 R2, see the "Obtain a Certificate" topic in the Certificates snap-in Help and the "Certreq" topic in the Windows Server 2008 R2 Command Reference. To review the Certificates snap-in Help topics, click Start, click Run, type hh certmgr.chm, and then click OK. For information about how to request certificates for Windows Server 2003, see Requesting Certificates (http://go.microsoft.com/fwlink/?LinkID=19638).

    A stand-alone or enterprise CA-issued certificate must be co-signed by a trusted public CA that participates in the Microsoft Root Certification Program Members program (http://go.microsoft.com/fwlink/?LinkID=59547). Otherwise, users connecting from home computers or kiosks might not be able to connect to TS Gateway or RD Gateway servers. These connections might fail because the CA-issued root might not be trusted by computers that are not members of domains, such as home computers or kiosks.

  • If your company does not maintain a stand-alone or enterprise CA that is configured to issue SSL-compatible X.509 certificates, you can purchase a certificate from a trusted public CA that participates in the Microsoft Root Certificate Program Members program (http://go.microsoft.com/fwlink/?LinkID=59547). Some of these public CAs might offer certificates at no cost on a trial basis.

  • Alternatively, if your company does not maintain a stand-alone or enterprise CA and you do not have a compatible certificate from a trusted public CA, you can create and import a self-signed certificate for your RD Gateway server for technical evaluation and testing purposes. For more information, see Create a Self-Signed Certificate for the Remote Desktop Gateway Server.

    Important

    If you use either of the first two methods to obtain a certificate (that is, if you obtain a certificate from a stand-alone or enterprise CA or a trusted public CA), you must also Import a Certificate into Remote Desktop Gateway Server and Select an Existing Certificate for Remote Desktop Gateway. However, if you create a self-signed certificate by using the Add Roles Wizard during installation of the Remote Desktop Gateway role service or by using Remote Desktop Gateway Manager after installation (as described in Create a Self-Signed Certificate for the Remote Desktop Gateway Server), you do not need to install or map the certificate to the RD Gateway server. In this case, the certificate is automatically created, installed in the correct location on the RD Gateway server, and mapped to the RD Gateway server.

    Note that Remote Desktop Services clients must have the certificate of the CA that issued the server certificate in their Trusted Root Certification Authorities store. For step-by-step instructions for installing the certificate on the client, see Install the Remote Desktop Gateway Server Root Certificate on the Remote Desktop Services Client.

    If you used one of the first two methods to obtain a certificate and the Remote Desktop Services client computer trusts the issuing CA, you do not need to install the certificate of the CA that issued the server certificate in the client computer certificate store. For example, you do not need to install the certificate of the issuing CA in the client computer certificate store if a VeriSign or other public, trusted CA certificate is installed on the RD Gateway server. If you use the third method to obtain a certificate (that is, if you create a self-signed certificate), you do need to install the certificate of the CA that issued the server certificate in the Trusted Root Certification Authorities store on the client computer. For more information, see Install the Remote Desktop Gateway Server Root Certificate on the Remote Desktop Services Client.

Step 2: Import a certificate

After you obtain a certificate, you can import the certificate to the RD Gateway server by using one of the following methods:

  • To install a certificate to the certificate store and import the certificate to the RD Gateway server, see Import a Certificate into Remote Desktop Gateway Server.

  • To import an existing certificate from the certificate store to the RD Gateway server, see Select an Existing Certificate for Remote Desktop Gateway.

Additional references

  • Configure a Certificate for the Remote Desktop Gateway Server


Create a Self-Signed Certificate for the Remote Desktop Gateway Server

This procedure describes how to use Remote Desktop Gateway Manager to create a self-signed certificate, if you did not already create one by using the Add Roles Wizard when you installed the Remote Desktop Gateway role service.

Important

We recommend that you use self-signed certificates only for testing and evaluation purposes.

Membership in the local Administrators group, or equivalent, on the RD Gateway server that you plan to configure, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To create a self-signed certificate for the Remote Desktop Gateway server

  1. On the RD Gateway server, open Remote Desktop Gateway Manager. To open Remote Desktop Gateway Manager, click Start, point to Administrative Tools, point to Remote Desktop Services, and then click Remote Desktop Gateway Manager.

  2. In the Remote Desktop Gateway Manager console tree, right-click the local RD Gateway server, which is named for the computer on which the RD Gateway server is running, and then click Properties.

  3. In the results pane, under Configuration Status, click View or modify certificate properties.

  4. On the SSL Certificate tab, click Create a self-signed certificate, and then click Create and Import Certificate.

  5. In the Create Self-Signed Certificate dialog box, do the following:

    • In the Certificate name box, verify that the correct fully qualified domain name (FQDN) is specified for the self-signed certificate, or specify a new name. The FQDN must match the DNS name that the client uses to connect to the RD Gateway server, unless you are using wildcard certificates or the SAN attributes of certificates.

    • To store the root certificate in a specified location so that you can manually distribute the root certificate to clients, verify that the Store the root certificate check box is selected, and then specify where to store the certificate. By default, this check box is selected and the certificate is stored under the %Windir%\Users\<Username>\Documents folder.

    • Click OK.

  6. If you selected the Store the root certificate check box and specified a location for the certificate, a message will appear stating that RD Gateway has successfully created the self-signed certificate, and confirming the location of the stored certificate. Click OK to close the message.

  7. Click OK again to close the RD Gateway server Properties dialog box.

Additional considerations

  • For information about other methods for obtaining a certificate and certificate requirements for RD Gateway, see Obtain a Certificate for the Remote Desktop Gateway Server.

Additional references

  • Configure a Certificate for the Remote Desktop Gateway Server

  • Checklist: Configure Remote Desktop Gateway

  • Obtain a Certificate for the Remote Desktop Gateway Server


Select an Existing Certificate for Remote Desktop Gateway

After you obtain and install a certificate for the RD Gateway server, you must map the certificate to the RD Gateway server by using Remote Desktop Gateway Manager. If you map an RD Gateway server certificate by using any other method, RD Gateway will not function correctly.

Note

This procedure is not required if you created a self-signed certificate for RD Gateway.

Membership in the local Administrators group, or equivalent, on the RD Gateway server that you plan to configure, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To import the Remote Desktop Gateway certificate

  1. On the RD Gateway server, open Remote Desktop Gateway Manager. To open Remote Desktop Gateway Manager, click Start, point to Administrative Tools, point to Remote Desktop Services, and then click Remote Desktop Gateway Manager.

  2. In the Remote Desktop Gateway Manager console tree, right-click the local RD Gateway server, and then click Properties.

  3. In the Properties dialog box for the RD Gateway server, on the SSL Certificate tab, click Select an existing certificate from the RD Gateway <RD Gateway Server Name> Certificates (Local Computer)/Personal store, where <RD Gateway Server Name> is the name for the computer on which the RD Gateway server is running.

  4. Click Import Certificate.

  5. In the Import Certificate dialog box, click the certificate that you want to use, and then click Import.

  6. Click OK to close the Properties dialog box for the RD Gateway server.

    If this is the first time that you have mapped the RD Gateway certificate, after the certificate mapping is completed, you can verify that the mapping was successful by viewing the RD Gateway Server Status area in Remote Desktop Gateway Manager. Under Configuration Status and Configuration Tasks, the warning stating that a server certificate is not yet installed or selected and the View or modify certificate properties hyperlink are no longer displayed.

Additional references

  • Configure a Certificate for the Remote Desktop Gateway Server

  • Open the Remote Desktop Gateway Manager

  • Obtain a Certificate for the Remote Desktop Gateway Server

  • Checklist: Configure Remote Desktop Gateway


Import a Certificate into Remote Desktop Gateway Server

After you obtain a certificate, use this procedure to install the certificate in the correct store on the RD Gateway server, if the certificate is not already installed. Completing this procedure installs the certificate into the appropriate certificate store, and imports the certificate for the RD Gateway server.

Note

This procedure is not required if you created a self-signed certificate for RD Gateway by either selecting the Create a self-signed certificate for SSL encryption option when using the Add Remove Roles Wizard to install RD Gateway, or by selecting the Create a self-signed certificate option as described in Create a Self-Signed Certificate for the Remote Desktop Gateway Server after installing RD Gateway. In either case, a certificate is automatically created, installed in the correct location on the RD Gateway server, and mapped to the RD Gateway server.

Membership in the local Administrators group, or equivalent, on the RD Gateway server that you plan to configure, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To install a certificate on the Remote Desktop Gateway server

  1. On the RD Gateway server, open Remote Desktop Gateway Manager. To open Remote Desktop Gateway Manager, click Start, point to Administrative Tools, point to Remote Desktop Services, and then click Remote Desktop Gateway Manager.

  2. In the Remote Desktop Gateway Manager console tree, right-click the local RD Gateway server, and then click Properties.

  3. In the Properties dialog box for the RD Gateway server, on the SSL Certificate tab, click Import a certificate into the RD Gateway<RD Gateway Server Name> Certificates (Local Computer)/Personal store, where <RD Gateway Server Name> is the name for the computer on which the RD Gateway server is running.

  4. Click Browse and Import Certificate.

  5. In the Open dialog box, click the certificate that you want to use, and then click Open.

  6. In the Enter Private Key Password dialog box, in the Private key password box, enter the password for the certificate, and then click OK.

  7. In the Certificate Import dialog box, click OK.

  8. Click OK to close the Properties dialog box for the RD Gateway server.

    If this is the first time that you have mapped the RD Gateway certificate, after the certificate mapping is completed, you can verify that the mapping was successful by viewing the RD Gateway Server Status area in Remote Desktop Gateway Manager. Under Configuration Status and Configuration Tasks, the warning stating that a server certificate is not yet installed or selected and the View or modify certificate properties hyperlink are no longer displayed.

Additional references

  • Configure a Certificate for the Remote Desktop Gateway Server

  • Obtain a Certificate for the Remote Desktop Gateway Server

  • Create a Self-Signed Certificate for the Remote Desktop Gateway Server

  • Checklist: Configure Remote Desktop Gateway


View or Modify Certificate Properties

Membership in the local Administrators group, or equivalent, on the RD Gateway server that you plan to configure, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To view or modify certificate properties

  1. On the RD Gateway server, open Remote Desktop Gateway Manager. To open Remote Desktop Gateway Manager, click Start, point to Administrative Tools, point to Remote Desktop Services, and then click Remote Desktop Gateway Manager.

  2. In the Remote Desktop Gateway Manager console tree, right-click the local RD Gateway server, and then click Properties.

  3. In the Properties dialog box for the RD Gateway server, on the SSL Certificate tab, click Select an existing certificate from the RD Gateway <RD Gateway Server Name> Certificates (Local Computer)/Personal store, where <RD Gateway Server Name> is the name for the computer on which the RD Gateway server is running.

  4. Click Import Certificate, and then do one of the following in the Import Certificate dialog box:

    • To map a different certificate to the RD Gateway server, select the certificate that you want this RD Gateway server to use, and then click Import. On the SSL Certificates tab, review the Issued to, Issued by, and Expiration date fields to verify that the correct certificate is mapped to the RD Gateway server.

    • To view the properties for a certificate that is installed on the RD Gateway server, select the certificate that you want to view, and then click View Certificate. In the Certificate dialog box, review the certificate properties, click OK to close the Certificate dialog box, and then click Cancel to close the Install Certificate dialog box.

  5. Click OK to close the RD Gateway server Properties dialog box.

Additional references

  • Configure a Certificate for the Remote Desktop Gateway Server

  • Open the Remote Desktop Gateway Manager

  • Checklist: Configure Remote Desktop Gateway


Specify a Remote Desktop Gateway Server to Manage

After you install the RD Gateway role service and open Remote Desktop Gateway Manager on that server, by default, Remote Desktop Gateway Manager will display the details for that server.

If you plan to manage a remote RD Gateway server, membership in the Administrators group, or equivalent, on the RD Gateway server that you plan to manage remotely, is the minimum required to complete this procedure. Specifically, you must log on to the local computer with a domain account that is a member of the Administrators group or equivalent, on the RD Gateway server that you plan to manage remotely. Alternatively, you can open Remote Desktop Gateway Manager while logged on under such an account. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To manage a Remote Desktop Gateway server

  1. On the RD Gateway server, open Remote Desktop Gateway Manager. To open Remote Desktop Gateway Manager, click Start, point to Administrative Tools, point to Remote Desktop Services, and then click Remote Desktop Gateway Manager.

  2. In the Remote Desktop Gateway Manager console tree, right-click Remote Desktop Gateway Manager, and then click Connect to RD Gateway Server.

  3. In the Add an RD Gateway Server to Manage dialog box, specify whether to connect to a local server or to a remote server by doing either of the following:

    • To connect to a local RD Gateway server, click Local Server (the server this snap-in console is running on).

    • To connect to a remote RD Gateway server, enter the name of the RD Gateway server that you want to connect to in the Remote server box. Alternatively, click Browse to select the RD Gateway server, and in the Select Computer dialog box, specify the domain in which the server is located, specify all or part of the server name, and then click OK to close the Select Computer dialog box.

  4. Click OK.

Additional references

  • Configuring the Remote Desktop Gateway Server

  • Install the Remote Desktop Gateway Role Service

  • Obtain a Certificate for the Remote Desktop Gateway Server

  • Open the Remote Desktop Gateway Manager


Create a Remote Desktop Gateway Server Farm

RD Gateway uses two connections for each client session: one for inbound traffic and one for outbound traffic. This procedure is required to ensure that if a load balancer distributes each connection to a different RD Gateway server, the traffic from both connections will be redirected to the same RD Gateway server.

Important

You must already have load balancing configured before completing this procedure. RD Gateway does not perform load balancing itself. This procedure only ensures that RD Gateway will function correctly with a load-balancing solution that is already in place.

Membership in the local Administrators group, or equivalent, on the RD Gateway server that you plan to configure, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

Important

The RD Gateway servers that you add to the RD Gateway server farm must be domain members, and they must each have identical Remote Desktop connection authorization policies (RD CAPs) and Remote Desktop resource authorization policies (RD RAPs).

To create a Remote Desktop Gateway server farm

  1. On the RD Gateway server, open Remote Desktop Gateway Manager. To open Remote Desktop Gateway Manager, click Start, point to Administrative Tools, point to Remote Desktop Services, and then click Remote Desktop Gateway Manager.

  2. In the Remote Desktop Gateway Manager console tree, click to select the node that represents your RD Gateway server, which is named for the computer on which the RD Gateway server is running.

  3. In the results pane, under Configuration Status, click Add RD Gateway server farm members (if you have already added one or more RD Gateway servers to the server farm, the hyperlink title will appear as View RD Gateway server farm members).

  4. In the Properties dialog box for the RD Gateway server, on the Server Farm tab, in the RD Gateway server farm member box, type the name of the RD Gateway server that you want to add to the farm, and then click Add.

    Note

    You can specify a NetBIOS name, a fully qualified domain name (FQDN), or an IP address for each RD Gateway server when you add it to the farm, but the name must match the name for the RD Gateway server that is used in Active Directory Domain Services.

    After you click Add, the RD Gateway server name will appear under Remote Desktop Gateway server farm status.

  5. Repeat step 4 as needed, making sure that you add the names of all the other members of the RD Gateway server farm, and that you include the name of the local RD Gateway server. The list of RD Gateway server farm members must be identical on each RD Gateway server in the farm.

  6. Click OK.

Additional considerations

  • RD Gateway will interoperate with Network Load Balancing or non-Microsoft load-balancing devices for load balancing.

  • In a load-balanced environment, RD Gateway servers are grouped into farms, with each farm being represented to Remote Desktop Services clients as a single computer name with one IP address.

Additional references

  • Configuring the Remote Desktop Gateway Server

  • Checklist: Configure Remote Desktop Gateway

  • Open the Remote Desktop Gateway Manager


Remove Members of a Remote Desktop Gateway Server Farm

Membership in the local Administrators group, or equivalent, on the RD Gateway server that you plan to configure, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To remove members of a Remote Desktop Gateway server farm

  1. On the RD Gateway server, open Remote Desktop Gateway Manager. To open Remote Desktop Gateway Manager, click Start, point to Administrative Tools, point to Remote Desktop Services, and then click Remote Desktop Gateway Manager.

  2. In the Remote Desktop Gateway Manager console tree, click to select the node that represents your RD Gateway server, which is named for the computer on which the RD Gateway server is running.

  3. In the results pane, under Configuration Status, click View RD Gateway server farm members.

  4. In the Properties dialog box for the RD Gateway server, on the Server Farm tab, under Remote Desktop Gateway server farm status, click the RD Gateway server that you want to remove, and then click Remove.

  5. In the RD Gateway dialog box, click Yes.

  6. To remove additional RD Gateway servers, repeat steps 4 and 5 as necessary. Ensure that you repeat these steps for each server in the farm so that the list of members is the same for each server in the farm.

Additional references

  • Configuring the Remote Desktop Gateway Server

  • Create a Remote Desktop Gateway Server Farm

  • Checklist: Configure Remote Desktop Gateway

  • Open the Remote Desktop Gateway Manager


Disable Management for a Remote Desktop Gateway Server

You can use this procedure to stop managing an RD Gateway server. To specify a different RD Gateway server to manage (or to manage the same RD Gateway server again at a later time), see Specify a Remote Desktop Gateway Server to Manage.

Membership in the local Administrators group, or equivalent, on the RD Gateway server that you plan to configure, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To disable management for a Remote Desktop Gateway server

  1. On the RD Gateway server, open Remote Desktop Gateway Manager. To open Remote Desktop Gateway Manager, click Start, point to Administrative Tools, point to Remote Desktop Services, and then click Remote Desktop Gateway Manager.

  2. In the Remote Desktop Gateway Manager console tree, click to select the node that represents the RD Gateway server for which you want to disable management.

  3. Right-click the RD Gateway server, and then click Do not manage this server.

  4. A message will appear, prompting you to confirm whether you want to stop managing the specified RD Gateway server. To confirm, click Yes.

Additional references

  • Configuring the Remote Desktop Gateway Server

  • Checklist: Configure Remote Desktop Gateway


Understanding Authorization Policies for Remote Desktop Gateway

After you install the RD Gateway role service and configure a certificate for the RD Gateway server, you must create Remote Desktop connection authorization policies (RD CAPs), computer groups, and Remote Desktop resource authorization policies (RD RAPs).

This topic describes how RD CAPs, computer groups, and RD RAPs enable you to control remote user access to internal network resources (computers) when those users connect to the internal network over the Internet through RD Gateway.

RD CAPs

RD CAPs allow you to specify who can connect to an RD Gateway server. You can specify a user group that exists on the local RD Gateway server or in Active Directory Domain Services. You can also specify other conditions that users must meet to access an RD Gateway server. You can list specific conditions in each RD CAP. For example, you might require a group of users to use a smart card to connect through RD Gateway.

Important

Users are granted access to an RD Gateway server if they meet the conditions specified in the RD CAP. You must also create a Remote Desktop resource authorization policy (RD RAP). An RD RAP allows you to specify the network resources (computers) that users can connect to through RD Gateway. Until you create both an RD CAP and an RD RAP, users cannot connect to network resources through this RD Gateway server.

For information about how to create RD CAPs, see Manage Remote Desktop Connection Authorization Policies (RD CAPs).

RD RAPs

RD RAPs allow you to specify the internal network resources that remote users can connect to through an RD Gateway server. When you create an RD RAP, you can create a computer group (a list of computers on the internal network to which you want the remote users to connect) and associate it with the RD RAP.

Remote users connecting to an internal network through an RD Gateway server are granted access to computers on the network if they meet the conditions specified in at least one RD CAP and one RD RAP.

Note

When you associate an RD Gateway-managed computer group with an RD RAP, you can support both fully qualified domain names (FQDNs) and NetBIOS names by adding both names to the RD Gateway-managed computer group separately. When you associate an Active Directory security group with an RD RAP, both FQDNs and NetBIOS names are supported automatically if the internal network computer that the client is connecting to belongs to the same domain as the RD Gateway server. If the internal network computer belongs to a different domain than the RD Gateway server, users must specify the FQDN of the internal network computer.

For information about how to create RD RAPs, see Manage Remote Desktop Resource Authorization Policies (RD RAPs).

Together, RD CAPs and RD RAPs provide two different levels of authorization to provide you with the ability to configure a more specific level of access control to computers on an internal network.

Network resource groups and RD Gateway-managed computer groups associated with RD RAPs

Remote users can connect through RD Gateway to internal network resources in a security group or an RD Gateway-managed computer group. The group can be any one of the following:

  • Select an Active Directory Domain Services network resource group. The network resource group already exists in Active Directory Domain Services.

  • Select an existing RD Gateway-managed group or create a new one. You can configure an RD Gateway-managed computer group or select an existing one, by using Remote Desktop Gateway Manager after installation.

    An RD Gateway-managed computer group will not appear in Local Users and Groups on the RD Gateway server, nor can it be configured by using Local Users and Groups.

  • Allow users to connect to any network resource. In this case, users can connect to any computer on the internal network that they could connect to when they use Remote Desktop Connection.

Additional references

  • Configuring the Remote Desktop Gateway Server


Manage Remote Desktop Connection Authorization Policies (RD CAPs)

This section provides procedures for configuring Remote Desktop connection authorization policies (RD CAPs), which allow Remote Desktop Services clients to connect to an RD Gateway server. The following topics are covered:

  • Understanding Requirements for Connecting to a Remote Desktop Gateway Server

  • Create an RD CAP

  • Enable or Disable an RD CAP

  • View Details About Local RD CAPs

  • Modify or Remove a Local RD CAP

  • Specify a New Central RD CAP Store

  • Specify an Existing Local or Central RD CAP Store

  • Remove a Server Running NPS or Change a Server Shared Secret for a Centrally Stored RD CAP


Understanding Requirements for Connecting to a Remote Desktop Gateway Server

Users on Remote Desktop Services clients must meet specific requirements before they can connect to RD Gateway. These requirements include the following:

  • Supported Windows authentication method (required). You can configure the authentication methods that the RD Gateway server will allow by using Remote Desktop Gateway Manager. On clients, you can configure the authentication method to be used to connect to the RD Gateway server by using Group Policy.

    Important

    A client and the RD Gateway server to which the client connects must have at least one common authentication method, or the client connection attempt to the RD Gateway server will fail.

    Note

    If you configure the authentication method on the client by using Group Policy, keep in mind that Group Policy settings for Remote Desktop Services client connections can be applied in one of two ways. These policy settings can either be suggested (that is, they can be enabled, but not enforced) or they can be enabled and enforced. For more information, see Using Group Policy to Manage Client Connections Through Remote Desktop Gateway.

  • User group membership (required). You configure the user group membership requirement by using Remote Desktop Gateway Manager.

  • Client computer group membership (optional). You configure the client computer group membership requirement by using Remote Desktop Gateway Manager.

  • In Remote Desktop Gateway Manager, you configure these requirements on the Requirements tab of a Remote Desktop connection authorization policy (RD CAP). For more information, see Create an RD CAP.

Supported Windows authentication methods

If you configure the supported Windows authentication method by using Remote Desktop Gateway Manager, you can specify that a user must use either a password or a smart card, or both. If you select both methods, either can be used to connect.

If you configure the supported Windows authentication method by using Group Policy, the following options are available:

  • Ask for credentials, use NTLM protocol (a Windows NT challenge/response protocol). For information about the NTLM protocol, see Logon and Authentication Technologies (http://go.microsoft.com/fwlink/?LinkId=94215) and Microsoft NTLM (http://go.microsoft.com/fwlink/?LinkId=94216).

  • Ask for credentials, use Basic protocol. The Basic authentication method is a widely used industry-standard method for collecting user name and password information. It is less secure, however, because the passwords are transmitted in Base64-encoded form, not encrypted. For more information, see Basic Authentication (http://go.microsoft.com/fwlink/?LinkId=94217).

  • Use locally logged-on credentials. In this case, the same credentials that users provide to log on to their local computer will be used to connect to the RD Gateway server. Note that if you select this option, but users have previously connected to the same RD Gateway server and they have selected the Remember my credentials check box in the RD Gateway Server Settings dialog box on their client computer, their saved credentials will be used to connect to the RD Gateway server.

  • Use smart card. Smart cards contain a microcomputer and a small amount of memory, and they provide secure, tamper-proof storage for private keys and X.509 security certificates. A smart card is a form of two-factor authentication that requires the user to have a smart card and know the PIN to gain access to network resources. For more information, see The Secure Access Using Smart Cards Planning Guide (http://go.microsoft.com/fwlink/?LinkId=94218).

  • If all of these credentials are available to users, and if users have already specified to save their credentials when connecting to the RD Gateway server, their credentials will be used in the following order:

  1. Saved credentials

  2. Locally logged-on credentials

  3. Other password or smart card credentials supplied by the user

Additional references

  • For information about how to configure supported Windows authentication methods for RD Gateway by using Group Policy, see Set the Remote Desktop Gateway Server Authentication Method.

  • For information about how to configure supported Windows authentication methods by using Remote Desktop Gateway Manager, see Create an RD CAP.

  • For information about how to configure user group and client computer group membership requirements by using Remote Desktop Gateway Manager, see Create an RD CAP.

  • Manage Remote Desktop Connection Authorization Policies (RD CAPs)


Create an RD CAP

Remote Desktop connection authorization policies (RD CAPs) allow you to specify who can connect to an RD Gateway server. This procedure describes how to create a new local RD CAP. Alternatively, you can specify a central RD CAP store. For more information, see Specify a New Central RD CAP Store or Specify an Existing Local or Central RD CAP Store.

Important

If you have not done so already, you must also create a Remote Desktop resource authorization policy (RD RAP). Until you create both an RD CAP and an RD RAP, users cannot connect to network resources through this RD Gateway server.

This procedure describes how to use Remote Desktop Gateway Manager to create a custom RD CAP. Alternatively, you can use the Authorization Policies Wizard to quickly create an RD CAP and an RD RAP for RD Gateway.

Membership in the local Administrators group, or equivalent, on the RD Gateway server that you plan to configure, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To create an RD CAP

  1. On the RD Gateway server, open Remote Desktop Gateway Manager. To open Remote Desktop Gateway Manager, click Start, point to Administrative Tools, point to Remote Desktop Services, and then click Remote Desktop Gateway Manager.

  2. In the console tree, click to expand the node that represents the RD Gateway server, which is named for the computer on which the RD Gateway server is running.

  3. In the console tree, expand Policies, and then click Connection Authorization Policies.

  4. Right-click the Connection Authorization Policies folder, point to Create New Policy, and then click Custom.

  5. In the New RD CAP dialog box, on the General tab, in the Policy name box, enter a name for the policy, and then verify that the Enable this policy check box is selected.

  6. On the Requirements tab, under Supported Windows authentication methods, select one or both of the following check boxes:

    • Password

    • Smart card

    When both of these options are selected, clients that use either authentication method are allowed to connect.

  7. Under User group membership (required), click Add Group, and then specify a user group whose members can connect to the RD Gateway server. You must specify at least one user group.

  8. In the Select Groups dialog box, specify the user group location and name, and then click OK as needed to check the name and to close the Select Groups dialog box. To specify more than one user group, do either of the following:

    • Type the name of each user group, separating the name of each group with a semi-colon.

    • Add additional groups from different domains by repeating this step for each group.

  9. To specify optional additional computer domain membership criteria that client computers must meet, on the Requirements tab, under Client computer group membership (optional), click Add Group, and then specify the computer groups.

    To specify the computer groups, you can use the same steps that you used to specify user groups.

  10. On the Device Redirection tab, select one of the following options to enable or disable redirection for remote client devices:

    • To permit all client devices to be redirected when connecting through the RD Gateway server, click Enable device redirection for all client devices. By default, this option is selected.

    • To disable device redirection for only certain device types when connecting through the RD Gateway server, click Disable device redirection for the following client device types, and then select the check boxes that correspond to the client device types for which device redirection should be disabled.

  11. To only allow client connection to servers that enforce secure device redirection, on the Device Redirection tab, click Only allow client connections to Remote Desktop Session Host servers that enforce RD Gateway device redirection.

    Caution

    Selecting Only allow client connections to Remote Desktop Session Host servers that enforce RD Gateway device redirection will prevent users that are running versions older than Remote Desktop Connection (RDC) 7.0 from connecting.

  12. On the Timeouts tab, select the following options to enable or disable timeouts:

    • To set disconnection timeout settings for an idle remote session when connecting through the RD Gateway server, select the Enable idle timeout check box. In the Disconnect session after idle for box, enter the time, in minutes, to set the maximum time that a remote session can be idle before the session is disconnected.

    • To set session timeout settings for a remote session when connecting through the RD Gateway server, select the Enable session timeout check box. In the Time out session after box, enter the time, in minutes, to set the time for session timeout to take effect. Select the action to take after the user session timeout is reached:

      • To disconnect the remote session, click Disconnect session.

      • To have the session continue uninterrupted, unless changes to the user profile have been made, click Silently re-authenticate and reauthorize session.

  13. Click OK.

    The new local RD CAP that you created appears in the Remote Desktop Gateway Manager results pane. When you click the name of the RD CAP, the policy details appear in the lower pane.

Additional references

  • Manage Remote Desktop Connection Authorization Policies (RD CAPs)

  • Checklist: Configure Remote Desktop Gateway

  • Understanding Authorization Policies for Remote Desktop Gateway

  • Open the Remote Desktop Gateway Manager


Enable or Disable an RD CAP

Membership in the local Administrators group, or equivalent, on the RD Gateway server that you plan to configure, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To enable or disable an RD CAP

  1. On the RD Gateway server, open Remote Desktop Gateway Manager. To open Remote Desktop Gateway Manager, click Start, point to Administrative Tools, point to Remote Desktop Services, and then click Remote Desktop Gateway Manager.

  2. In the console tree, click to expand the node that represents the local RD Gateway server, which is named for the computer on which the RD Gateway server is running.

  3. In the console tree, expand Policies, and then click Connection Authorization Policies.

  4. In the results pane, in the list of RD CAPs, right-click the RD CAP that you want to enable or disable, and then click Enable or Disable.

Additional references

  • Manage Remote Desktop Connection Authorization Policies (RD CAPs)

  • Open the Remote Desktop Gateway Manager


View Details About Local RD CAPs

You can use Remote Desktop Gateway Manager to view details about local Remote Desktop connection authorization policies (RD CAPs), including the requirements that users must meet to connect to an RD Gateway server and whether the RD CAP is enabled or disabled.

Membership in the local Administrators group, or equivalent, on the RD Gateway server that you plan to configure, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To view details about local RD CAPs

  1. On the RD Gateway server, open Remote Desktop Gateway Manager. To open Remote Desktop Gateway Manager, click Start, point to Administrative Tools, point to Remote Desktop Services, and then click Remote Desktop Gateway Manager.

  2. In the console tree, click to expand the node that represents the local RD Gateway server, which is named for the computer on which the RD Gateway server is running.

  3. In the console tree, expand Policies, and then click Connection Authorization Policies.

  4. In the results pane, in the list of local RD CAPs, click the local RD CAP for which you want to view details. Details for the local RD CAP that you select appear in the lower section of the results pane.

Additional references

  • Manage Remote Desktop Connection Authorization Policies (RD CAPs)

  • Open the Remote Desktop Gateway Manager


Modify or Remove a Local RD CAP

Membership in the local Administrators group, or equivalent, on the RD Gateway server that you plan to configure, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To modify or remove a local RD CAP

  1. On the RD Gateway server, open Remote Desktop Gateway Manager. To open Remote Desktop Gateway Manager, click Start, point to Administrative Tools, point to Remote Desktop Services, and then click Remote Desktop Gateway Manager.

  2. In the console tree, click to expand the node that represents the local RD Gateway server, which is named for the computer on which the RD Gateway server is running.

  3. In the console tree, expand Policies, and then click Connection Authorization Policies.

  4. Do one of the following:

    • To modify the RD CAP, in the results pane, in the list of RD CAPs, right-click the RD CAP, click Properties, modify settings as needed, and then click OK.

    • To remove the RD CAP, in the results pane, in the list of RD CAPs, right-click the RD CAP, and then click Delete.

Additional references

  • Manage Remote Desktop Connection Authorization Policies (RD CAPs)

  • Open the Remote Desktop Gateway Manager


Specify a New Central RD CAP Store

Remote Desktop connection authorization policies (RD CAPs) allow you to specify who can connect to an RD Gateway server. You can specify a local RD CAP store (RD CAPs that are stored on the RD Gateway server) or a central RD CAP store [RD CAPs that are stored on a central server that is running Network Policy Server (NPS), formerly known as a Remote Authentication Dial-In User Service (RADIUS) server].

By using a central server running NPS for RD Gateway, you can centralize the storage, management, and validation of RD CAPs.

If you use a central RD CAP store, you must establish a network connection from the RD Gateway server to the server running NPS. To do this, you must specify a shared secret.

When you create and use the shared secret, you must use the same case-sensitive shared secret that you specified when configuring the RD Gateway server as a RADIUS client on the central server running NPS.

We also recommend that you do the following:

  • Generate long shared secrets (more than 22 characters) comprised of a random sequence of letters, numbers, and punctuation.

  • Change the shared secret often.

Important

If you have not done so already, you must also create a Remote Desktop resource authorization policy (RD RAP).

Membership in the local Administrators group, or equivalent, on the RD Gateway server that you plan to configure, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To specify a new central RD CAP store

  1. On the RD Gateway server, open Remote Desktop Gateway Manager. To open Remote Desktop Gateway Manager, click Start, point to Administrative Tools, point to Remote Desktop Services, and then click Remote Desktop Gateway Manager.

  2. In the console tree, click to expand the node that represents the local RD Gateway server, which is named for the computer on which the RD Gateway server is running.

  3. In the console tree, expand Policies, and then click Connection Authorization Policies.

  4. Right-click the Connection Authorization Policies folder, and then click Configure Central RD CAP.

  5. In the Properties dialog box for the RD Gateway server, on the RD CAP Store tab, click Central server running NPS, enter the name or IP address of the server running NPS that you want to add, and then click Add.

  6. In the Shared Secret dialog box, in the Enter a new shared secret box, enter the shared secret.

  7. Click OK to close the Shared Secret dialog box, and then click OK to close the Properties dialog box for the RD Gateway server.

    The new central RD CAP store that you specified appears in the Remote Desktop Gateway Manager results pane.

    After you specify the new central RD CAP store, you must also configure settings and policies as needed on the central server running NPS. For more information about RD Gateway, see the Remote Desktop Services page on the Windows Server 2008 R2 TechCenter (http://go.microsoft.com/fwlink/?LinkId=140433).

Additional references

  • Manage Remote Desktop Connection Authorization Policies (RD CAPs)

  • Checklist: Configure Remote Desktop Gateway

  • Understanding Authorization Policies for Remote Desktop Gateway

  • Open the Remote Desktop Gateway Manager


Specify an Existing Local or Central RD CAP Store

Remote Desktop connection authorization policies (RD CAPs) allow you to specify who can connect to an RD Gateway server. You can specify a local RD CAP store (RD CAPs that are stored on the RD Gateway server) or a central RD CAP store [RD CAPs that are stored on a central server that is running Network Policy Server (NPS), formerly known as a Remote Authentication Dial-In User Service (RADIUS) server].

This procedure describes how to specify an existing local or central RD CAP store. Alternatively, you can create a new local RD CAP or you can specify a new central RD CAP store. For more information, see Create an RD CAP or Specify a New Central RD CAP Store. Centrally stored RD CAPs are stored on servers running NPS.

Important

If you have not done so already, you must also create a Remote Desktop resource authorization policy (RD RAP).

Membership in the local Administrators group, or equivalent, on the RD Gateway server that you plan to configure, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To specify an existing local or central RD CAP store

  1. On the RD Gateway server, open Remote Desktop Gateway Manager. To open Remote Desktop Gateway Manager, click Start, point to Administrative Tools, point to Remote Desktop Services, and then click Remote Desktop Gateway Manager.

  2. In the Remote Desktop Gateway Manager console tree, right-click the local RD Gateway server, and then click Properties.

  3. In the Properties dialog box for the RD Gateway server, on the RD CAP Store tab, do one of the following:

    • To specify a local RD CAP store, click Local server running NPS, and then click OK.

    • To specify a central RD CAP store, click Central server running NPS, click the name of the server running NPS that you want, and then click OK.

      If you specify a central RD CAP store, you must also ensure that settings and policies are configured as needed on the central server running NPS. For more information about RD Gateway, see the Remote Desktop Services page on the Windows Server 2008 R2 TechCenter (http://go.microsoft.com/fwlink/?LinkId=140433).

Additional considerations

You can remove or change the shared secret for a central RD CAP store. For information, see Remove a Server Running NPS or Change a Server Shared Secret for a Centrally Stored RD CAP.

Additional references

  • Manage Remote Desktop Connection Authorization Policies (RD CAPs)

  • Checklist: Configure Remote Desktop Gateway

  • Understanding Authorization Policies for Remote Desktop Gateway

  • Open the Remote Desktop Gateway Manager


Remove a Server Running NPS or Change a Server Shared Secret for a Centrally Stored RD CAP

If you are changing the shared secret for a server that is running Network Policy Server (NPS) on which a central Remote Desktop connection authorization policy (RD CAP) is stored, keep in mind that you must use the same case-sensitive shared secret that you specified when configuring the RD Gateway server as a RADIUS client on the central server running NPS.

We also recommend that you do the following:

  • Generate long shared secrets (more than 22 characters) comprised of a random sequence of letters, numbers, and punctuation.

  • Change the shared secret often.

Membership in the local Administrators group, or equivalent, on the RD Gateway server that you plan to configure, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To remove a server running NPS or change the shared secret for a server running NPS for a centrally stored RD CAP

  1. On the RD Gateway server, open Remote Desktop Gateway Manager. To open Remote Desktop Gateway Manager, click Start, point to Administrative Tools, point to Remote Desktop Services, and then click Remote Desktop Gateway Manager.

  2. In the console tree, click to expand the node that represents the local RD Gateway server, which is named for the computer on which the RD Gateway server is running.

  3. In the console tree, expand Policies, and then click Central Network Policy Servers.

  4. In the results pane, in the list of central Network Policy Servers, click the name of the server running NPS that you want to remove or whose shared secret you want to modify.

  5. On the Action menu, click Configure Central RD CAP.

  6. In the Properties dialog box for the RD Gateway server, on the RD CAP Store tab, do either of the following:

    • To remove a server that is running NPS, click the name of the server running NPS that you want to remove, and then click Remove Server Running NPS.

      If only one server running NPS is specified and you remove it from the list, you must add another server running NPS to the list if you plan to use a centrally stored RD CAP.

    • To change the shared secret for a server running NPS, click the name of the server running NPS for which you want to change the shared secret, and then click Change Shared Secret. In the Shared Secret dialog box, enter a new shared secret in the Enter a new shared secret box, and then click OK.

  7. Click OK to close the Properties dialog box for the RD Gateway server.

Additional references

  • Manage Remote Desktop Connection Authorization Policies (RD CAPs)

  • Checklist: Configure Remote Desktop Gateway

  • Understanding Authorization Policies for Remote Desktop Gateway

  • Open the Remote Desktop Gateway Manager


Manage Remote Desktop Resource Authorization Policies (RD RAPs)

This section provides procedures for managing Remote Desktop resource authorization policies (RD RAPs), which allow you to specify the internal network resources (computers) that remote users can connect to through an RD Gateway server. The following topics are covered:

  • Create an RD RAP

  • Specify Computers That Users Can Connect to Through Remote Desktop Gateway

  • Enable or Disable an RD RAP

  • View Details about RD RAPs

  • Modify or Remove a Remote Desktop Gateway-Managed Computer Group

  • Modify or Remove an RD RAP


Create an RD RAP

Remote Desktop resource authorization policies (RD RAPs) allow you to specify the internal network resources (computers) that remote users can connect to through an RD Gateway server.

Remote users connecting to the network through an RD Gateway server are granted access to computers on the internal network if they meet the conditions specified in at least one RD CAP and one RD RAP.

Note

When you associate an RD Gateway-managed computer group with an RD RAP, you can support both fully qualified domain names (FQDNs) and NetBIOS names by adding both names to the RD Gateway-managed computer group separately. When you associate an Active Directory security group or an RD Session Host server farm with an RD RAP, both FQDNs and NetBIOS names are supported automatically if the internal network computer that the client is connecting to belongs to the same domain as the RD Gateway server. If the internal network computer belongs to a different domain than the RD Gateway server, users must specify the FQDN of the internal network computer.

This procedure describes how to use Remote Desktop Gateway Manager to create a custom RD RAP. Alternatively, you can use the Authorization Policies Wizard to quickly create an RD CAPand an RD RAP for RD Gateway.

Membership in the local Administrators group, or equivalent, on the RD Gateway server that you plan to configure, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To create an RD RAP

  1. On the RD Gateway server, open Remote Desktop Gateway Manager. To open Remote Desktop Gateway Manager, click Start, point to Administrative Tools, point to Remote Desktop Services, and then click Remote Desktop Gateway Manager.

  2. In the Remote Desktop Gateway Manager console tree, click to expand the node that represents your RD Gateway server, which is named for the computer on which the RD Gateway server is running.

  3. In the console tree, expand Policies, and then click Resource Authorization Policies.

  4. In the console tree, right-click the Resource Authorization Policies folder, point to Create New Policy, and then click Custom.

  5. In the New RD RAP dialog box, on the General tab, in the Policy name box, enter a name that is no longer than 64 characters.

  6. In the Description box, enter a description for the new RD RAP, and then verify that the Enable this policy check box is selected.

  7. On the User Groups tab, click Add to select the user groups to which you want this RD RAP to apply.

  8. In the Select Groups dialog box, specify the user group location and name, and then click OK. To specify more than one user group, do either of the following:

    • Type the name of each user group, separating the name of each group with a semi-colon.

    • Add additional groups from different domains by repeating step 7 for each group.

  9. On the Network Resource tab, specify the computer group that users can connect to through RD Gateway. For information about how to create computer groups for RD Gateway, see Specify Computers That Users Can Connect to Through Remote Desktop Gateway.

  10. On the Allowed Ports tab, do one of the following to specify the port that Remote Desktop Services clients can use when connecting to computers through RD Gateway:

    • To restrict the port that clients use to TCP port 3389, click Allow connections only through TCP port 3389. This is the default option.

    • To specify different ports through which clients can connect, click Allow connections through these ports and then enter the port number. If you are specifying more than one port, type the number for each port separated by a semi-colon.

    • To allow clients to connect through any port, click Allow connections through any port.

  11. Click OK to close the New RD RAP dialog box

    The new RD RAP that you created appears in the Remote Desktop Gateway Manager results pane. When you click the name of the RD RAP, the policy details appear in the lower pane.

Additional references

  • Manage Remote Desktop Resource Authorization Policies (RD RAPs)

  • Checklist: Configure Remote Desktop Gateway

  • Understanding Authorization Policies for Remote Desktop Gateway

  • Specify Computers That Users Can Connect to Through Remote Desktop Gateway

  • Open the Remote Desktop Gateway Manager


Specify Computers That Users Can Connect to Through Remote Desktop Gateway

Remote users can connect through RD Gateway to internal network resources in an existing security group, an RD Gateway-managed computer group, or an RD Session Host server farm.

The group can be any of the following:

  • An existing Active Directory Domain Services network resource group.

  • An existing RD Gateway-managed group or a new RD Gateway-managed group.

    Important

    If users are connecting to members of a terminal server farm by using Terminal Services Session Broker (TS Session Broker) running on Windows Server 2008, you must select this option. The name of the farm and the name of each member must be specified in the computer group.

  • Any network resource.

Membership in the local Administrators group, or equivalent, on the RD Gateway server that you plan to configure, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To specify computers that users can connect to through RD Gateway

  1. On the RD Gateway server, open Remote Desktop Gateway Manager. To open Remote Desktop Gateway Manager, click Start, point to Administrative Tools, point to Remote Desktop Services, and then click Remote Desktop Gateway Manager.

  2. In the Remote Desktop Gateway Manager console tree, click to expand the node that represents your RD Gateway server, which is named for the computer on which the RD Gateway server is running.

  3. In the console tree, expand Policies, and then click Resource Authorization Policies.

  4. With the Resource Authorization Policies folder selected, right-click the RD RAP for which you want to specify a computer group, and then click Properties.

  5. On the Network Resource tab, specify the computer group that users can connect to through RD Gateway by doing one of the following:

    • To specify an existing Active Directory Domain Services network resource group, click Select an Active Directory Domain Services network resource group. This is the default option.

      1. Click Browse.

      2. In the Select Group dialog box, specify the user group location and name, and then click OK.

    • To specify an RD Gateway-managed computer group, click Select an existing RD Gateway-managed group or create a new one, and then click Browse. In the Select an RD Gateway-managed computer group dialog box, do one of the following:

      • Select an existing RD Gateway-managed computer group by clicking the name of the computer group that you want to use, and then click OK.

      • Create a new RD Gateway-managed computer group by clicking Create New Group.

        1. In the New RD Gateway-Managed Computer Group dialog box, on the General tab, in the Name box, enter a name for the new RD Gateway-managed computer group. In the Description box, enter a description.

        2. On the Network Resources tab, type the name or IP address of the computer or remote desktop farm that you want to add, and then click Add. Repeat this step as needed to specify additional computers, and then click OK to close the New RD Gateway-Managed Computer Group dialog box.

        3. In the Select an RD Gateway-managed computer group dialog box, click the name of the new computer group, and then click OK.

        Important

        When you add an internal corporate network computer to the list of RD Gateway-managed computers, keep in mind that if you want to allow remote users to connect to the computer by specifying either its computer name or its IP address, you must add the computer to the computer group twice (by specifying the computer name of the computer and adding it to the computer group and then specifying the IP address of the computer and adding it to the computer group again). If you specify only an IP address for a computer when you add it to a computer group, users must also specify the IP address of that computer when they connect to that computer through RD Gateway. To ensure that remote users connect to the internal corporate network computers that you intend, we recommend that you do not specify IP addresses for the computers, if the computers are not configured to use static IP addresses. For example, you should not specify IP addresses if your organization uses DHCP to dynamically reconfigure IP addresses for the computers.

    • To specify any network resource, click Allow users to connect to any network resource, and then click OK.

Additional references

  • Checklist: Configure Remote Desktop Gateway

  • Create an RD RAP

  • Understanding Authorization Policies for Remote Desktop Gateway

  • Open the Remote Desktop Gateway Manager


Enable or Disable an RD RAP

Membership in the local Administrators group, or equivalent, on the RD Gateway server that you plan to configure, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To enable or disable an RD RAP

  1. On the RD Gateway server, open Remote Desktop Gateway Manager. To open Remote Desktop Gateway Manager, click Start, point to Administrative Tools, point to Remote Desktop Services, and then click Remote Desktop Gateway Manager.

  2. In the Remote Desktop Gateway Manager console tree, click to expand the node that represents the local RD Gateway server, which is named for the computer on which the RD Gateway server is running.

  3. In the console tree, expand Policies, and then click Resource Authorization Policies.

  4. In the results pane, in the list of RD RAPs, right-click the RD RAP that you want to enable or disable, and then click Enable or Disable.

Additional references

  • Manage Remote Desktop Resource Authorization Policies (RD RAPs)

  • Open the Remote Desktop Gateway Manager


View Details about RD RAPs

You can use Remote Desktop Gateway Manager to view details about Remote Desktop resource authorization policies (RD RAPs), including the names of the security groups or RD Gateway-managed computer groups and user groups associated with an RD RAP.

Membership in the local Administrators group, or equivalent, on the RD Gateway server that you plan to configure, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To view details about RD RAPs

  1. On the RD Gateway server, open Remote Desktop Gateway Manager. To open Remote Desktop Gateway Manager, click Start, point to Administrative Tools, point to Remote Desktop Services, and then click Remote Desktop Gateway Manager.

  2. In the Remote Desktop Gateway Manager console tree, click to expand the node that represents the local RD Gateway server, which is named for the computer on which the RD Gateway server is running.

  3. In the console tree, expand Policies, and then click Resource Authorization Policies.

  4. In the results pane, in the list of RD RAPs, click the RD RAP for which you want to view details. Details for the RD RAP that you select appear in the lower section of the results pane.

Additional references

  • Manage Remote Desktop Resource Authorization Policies (RD RAPs)


Modify or Remove a Remote Desktop Gateway-Managed Computer Group

You can use Remote Desktop Gateway Manager to modify or remove an RD Gateway-managed computer group.

If you associate an RD Gateway-managed computer group with multiple Remote Desktop resource authorization policies (RD RAPs) and you modify or delete the RD Gateway-managed computer group, all RD RAPs that are associated with the group will be affected.

Membership in the local Administrators group, or equivalent, on the RD Gateway server that you plan to configure, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To modify or remove a Remote Desktop Gateway-managed computer group

  1. On the RD Gateway server, open Remote Desktop Gateway Manager. To open Remote Desktop Gateway Manager, click Start, point to Administrative Tools, point to Remote Desktop Services, and then click Remote Desktop Gateway Manager.

  2. In the console tree, click to select the node that represents the local RD Gateway server, which is named for the computer on which the RD Gateway server is running.

  3. In the console tree, expand Policies, and then click Resource Authorization Policies.

  4. Right-click the Resource Authorization Policies folder, and then click Manage Local Computer Groups.

  5. In the Manage Locally Stored Computer Groups dialog box, do one of the following:

    • To modify an RD Gateway-managed computer group, in the list of groups, click the group that you want to modify, click Properties, and then modify the settings as needed.

    • To delete an RD Gateway-managed computer group, click the group that you want to delete, and then click Remove.

    • To specify a new RD Gateway-managed computer group, click Create Group, and then follow the steps in Specify Computers That Users Can Connect to Through Remote Desktop Gateway.

  6. Click OK.

Additional references

  • Manage Remote Desktop Resource Authorization Policies (RD RAPs)

  • Checklist: Configure Remote Desktop Gateway

  • Understanding Authorization Policies for Remote Desktop Gateway

  • Specify Computers That Users Can Connect to Through Remote Desktop Gateway

  • Open the Remote Desktop Gateway Manager


Modify or Remove an RD RAP

Membership in the local Administrators group, or equivalent, on the RD Gateway server that you plan to configure, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To modify or remove an RD RAP

  1. On the RD Gateway server, open Remote Desktop Gateway Manager. To open Remote Desktop Gateway Manager, click Start, point to Administrative Tools, point to Remote Desktop Services, and then click Remote Desktop Gateway Manager.

  2. In the Remote Desktop Gateway Manager console tree, click to expand the node that represents the local RD Gateway server, which is named for the computer on which the RD Gateway server is running.

  3. In the console tree, expand Policies, and then click Resource Authorization Policies.

  4. In the results pane, in the list of Remote Desktop resource authorization policies (RD RAPs), click the name of the RD RAP that you want to modify or remove.

  5. With the name of the RD RAP selected, do one of the following:

    • To modify the RD RAP, right-click the RD RAP, click Properties, modify settings as needed, and then click OK.

    • To remove the RD RAP, right-click the RD RAP, and then click Delete. When prompted to confirm whether you want to delete the RD RAP, click Yes.

Additional references

  • Manage Remote Desktop Resource Authorization Policies (RD RAPs)

  • Checklist: Configure Remote Desktop Gateway

  • Understanding Authorization Policies for Remote Desktop Gateway

  • Open the Remote Desktop Gateway Manager


Enable SSL Bridging on the Remote Desktop Gateway Server

To enhance security for an RD Gateway server, you can configure Microsoft Internet Security and Acceleration (ISA) Server or a non-Microsoft product to function as a Secure Sockets Layer (SSL) bridging device. The SSL bridging device can enhance security by terminating SSL sessions, inspecting packets, and re-establishing SSL sessions.

You can configure ISA Server communication with the RD Gateway server in either of the two following ways:

  • HTTPS-HTTPS bridging. In this configuration, the RD Gateway client initiates an SSL (HTTPS) request to the SSL bridging device. The SSL bridging device initiates a new HTTPS request to the RD Gateway server, for maximum security.

  • HTTPS-HTTP bridging. In this configuration, the RD Gateway client initiates an SSL (HTTPS) request to the SSL bridging device. The SSL bridging device initiates a new HTTP request to the RD Gateway server.

To use HTTPS-HTTPS or HTTPS-HTTP bridging, you must enable the Use SSL Bridging setting on the RD Gateway server, as described in this procedure.

Important

To use an SSL bridging device with RD Gateway, you must also enable external SSL termination on the SSL bridging device that you plan to use and you must configure it to connect to the RD Gateway server. For detailed instructions about configuring ISA Server for use as an external SSL bridging device for RD Gateway, see the Remote Desktop Services page on the Windows Server 2008 R2 TechCenter (http://go.microsoft.com/fwlink/?LinkId=140433).

Membership in the local Administrators group, or equivalent, on the RD Gateway server that you plan to configure, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To enable HTTPS-HTTP bridging on the Remote Desktop Gateway server

  1. On the RD Gateway server, open Remote Desktop Gateway Manager. To open Remote Desktop Gateway Manager, click Start, point to Administrative Tools, point to Remote Desktop Services, and then click Remote Desktop Gateway Manager.

  2. In the Remote Desktop Gateway Manager console tree, right-click the local RD Gateway server, and then click Properties.

  3. In the Properties dialog box for the RD Gateway server, on the SSL Bridging tab, select the Use SSL bridging check box, click HTTPS-HTTP bridging (terminate SSL requests and initiate new HTTP requests), and then click OK.

  4. In the RD Gateway dialog box, select one of the following options:

    • To recycle the default application pool now, click Yes.

      Caution

      You must recycle the default application pool of IIS for the SSL bridging settings to take effect. Selecting to recycle the IIS application pool containing RD Gateway will disconnect all active connections of all applications placed in this pool.

    • To recycle the default application pool manually later, click No.

    If you are using ISA Server as the external SSL bridging device for RD Gateway, for more information see the Remote Desktop Services page on the Windows Server 2008 R2 TechCenter (http://go.microsoft.com/fwlink/?LinkId=140433).
To enable HTTPS-HTTPS bridging on the Remote Desktop Gateway server

  1. On the RD Gateway server, open Remote Desktop Gateway Manager. To open Remote Desktop Gateway Manager, click Start, point to Administrative Tools, point to Remote Desktop Services, and then click Remote Desktop Gateway Manager.

  2. In the Remote Desktop Gateway Manager console tree, right-click the local RD Gateway server, and then click Properties.

  3. In the Properties dialog box for the RD Gateway server, on the SSL Bridging tab, select the Use SSL bridging check box, click HTTPS-HTTPS bridging (terminate SSL requests and initiate new HTTPS requests), and then click OK.

  4. In the RD Gateway dialog box, select one of the following options:

    • To recycle the default application pool now, click Yes.

      Caution

      You must recycle the default application pool of IIS for the SSL bridging settings to take effect. Selecting to recycle the IIS application pool containing RD Gateway will disconnect all active connections of all applications placed in this pool.

    • To recycle the default application pool manually later, click No.

    If you are using ISA Server as the external SSL bridging device for RD Gateway, for more information, see the Remote Desktop Services page on the Windows Server 2008 R2 TechCenter (http://go.microsoft.com/fwlink/?LinkId=140433).

Additional references

  • Manage Remote Desktop Connection Authorization Policies (RD CAPs)

  • Checklist: Configure Remote Desktop Gateway

  • Open the Remote Desktop Gateway Manager


Enable NAP Health Policy Checking on the Remote Desktop Gateway Server

To enhance security, you can configure RD Gateway servers and clients to use Network Access Protection (NAP). NAP is a health policy creation, enforcement, and remediation technology that is included in Windows Server 2008 R2, Windows Server 2008, Windows 7, Windows Vista, and Windows XP Service Pack 3. With NAP, system administrators can enforce health requirements on Remote Desktop Services clients that connect to the RD Gateway server, which can include firewalls being enabled, security update requirements, required computer configurations, and other settings.

By using NAP, you can help ensure that Remote Desktop Services clients meet the health policy requirements of your organization before they are allowed to connect to computers on the corporate network through RD Gateway servers.

Note

Computers running Windows Server 2008 R2 and Windows Server 2008 cannot be used as NAP clients. Only computers running Windows 7, Windows Vista, and Windows XP Service Pack 3 can be used as NAP clients.

To enable NAP health policy checking on the RD Gateway server, you enable a setting on the server that requests that the Remote Desktop Services client sends a statement of health (SoH).

Membership in the local Administrators group, or equivalent, on the RD Gateway server that you plan to configure, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To enable NAP health policy checking on the RD Gateway server

  1. On the RD Gateway server, open Remote Desktop Gateway Manager. To open Remote Desktop Gateway Manager, click Start, point to Administrative Tools, point to Remote Desktop Services, and then click Remote Desktop Gateway Manager.

  2. In the Remote Desktop Gateway Manager console tree, right-click the local RD Gateway server, and then click Properties.

  3. In the Properties dialog box for the RD Gateway server, on the RD CAP Store tab, verify that the Request clients to send a statement of health check box is selected, and then click OK.

    Ensure that you have properly configured the Remote Desktop Services clients, the RD Gateway server, and the server running NPS. For more information about RD Gateway, see the Remote Desktop Services page on the Windows Server 2008 R2 TechCenter (http://go.microsoft.com/fwlink/?LinkId=140433).

Additional references

  • Manage Remote Desktop Connection Authorization Policies (RD CAPs)

  • Checklist: Configure Remote Desktop Gateway

  • Open the Remote Desktop Gateway Manager


Limit the Maximum Number of Simultaneous Connections Through a Remote Desktop Gateway Server

By default, with the exception of RD Gateway servers that are running on Windows Server 2008 R2 Standard, no limit is set for the number of simultaneous connections that Remote Desktop Services clients can make to internal network resources (computers) through an RD Gateway server. You can optimize RD Gateway server performance by setting a limit for the number of simultaneous connections that clients can make to internal network resources through an RD Gateway server.

Note

For RD Gateway servers that are running on Windows Server 2008 R2 Standard, a maximum of 250 simultaneous connections is supported.

Membership in the local Administrators group, or equivalent, on the RD Gateway server that you plan to configure, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To limit the maximum number of simultaneous connections through a Remote Desktop Gateway server

  1. On the RD Gateway server, open Remote Desktop Gateway Manager. To open Remote Desktop Gateway Manager, click Start, point to Administrative Tools, point to Remote Desktop Services, and then click Remote Desktop Gateway Manager.

  2. In the Remote Desktop Gateway Manager console tree, right-click the local RD Gateway server, and then click Properties.

  3. In the Properties dialog box for the RD Gateway server, on the General tab, under Maximum Connections, do one of the following:

    • To set a limit for the maximum number of simultaneous connections that Remote Desktop Services clients can make to network resources through RD Gateway, click Limit maximum allowed simultaneous connections to, and then specify the number of allowable connections.

    • To set no limit on the number of allowable connections between clients and internal network resources through RD Gateway, click Allow the maximum supported simultaneous connections. This is the default option.

      Note

      For RD Gateway servers that are running on Windows Server 2008 R2 Standard, a maximum of 250 simultaneous connections is supported.

    • To prevent new connections from being made between clients and network resources through RD Gateway, click Disable new connections. If you select this option, only new connection attempts will be rejected. Current connections will not be ended by RD Gateway.

  4. Click OK.

Additional references

  • Configuring the Remote Desktop Gateway Server

  • Checklist: Configure Remote Desktop Gateway

  • Open the Remote Desktop Gateway Manager


Import or Export Settings for a Remote Desktop Gateway Server

To simplify administration and configuration for multiple RD Gateway servers, you can use Remote Desktop Gateway Manager to import or export policy and configuration settings for an RD Gateway server.

Membership in the local Administrators group, or equivalent, on the RD Gateway server that you plan to configure, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To import or export settings for a Remote Desktop Gateway server

  1. On the RD Gateway server, open Remote Desktop Gateway Manager. To open Remote Desktop Gateway Manager, click Start, point to Administrative Tools, point to Remote Desktop Services, and then click Remote Desktop Gateway Manager.

  2. In the Remote Desktop Gateway Manager console tree, right-click the local RD Gateway server, and then do one of the following:

    • To export settings for the RD Gateway server, click Export policy and configuration settings.

      1. In the Export policy and configuration settings dialog box, in the Specify a name for the file box, enter a name for the file, and in the Location box, enter a location for the file.

      2. Click OK.

        Note

        If the directory that you specify does not already exist, or if a file with the same name already exists, appropriate messages will appear to allow you to create the directory, or to overwrite the existing file, respectively.

      3. In the RD Gateway dialog box, click OK.

    • To import settings for an RD Gateway server, click Import policy and configuration settings.

      1. In the Import policy and configuration settings dialog box, in the Specify the file that you want to import box, enter a name and location for the file that you want to import.

      2. Click OK.

        Warning

        Importing the file will cause existing policy and configuration settings for the RD Gateway server to be overwritten.

      3. In the RD Gateway dialog box, click Yes. An RD Gateway message indicates that the import is in progress.

      4. In the RD Gateway dialog box, click OK.

Additional references

  • Configuring the Remote Desktop Gateway Server

  • Checklist: Configure Remote Desktop Gateway

  • Open the Remote Desktop Gateway Manager


Configure Messaging for a Remote Desktop Gateway Server

This procedure describes how to create and enable a system message or a logon message for an RD Gateway server.

Membership in the local Administrators group, or equivalent, on the RD Gateway server that you plan to configure, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To configure messaging on RD Gateway

  1. On the RD Gateway server, open Remote Desktop Gateway Manager. To open Remote Desktop Gateway Manager, click Start, point to Administrative Tools, point to Remote Desktop Services, and then click Remote Desktop Gateway Manager.

  2. In the Remote Desktop Gateway Manager console tree, right-click the local RD Gateway server, and then click Properties.

  3. In the Properties dialog box for the RD Gateway server, on the Messaging tab, set messaging as follows:

    • To set a system message:

      1. Select the Enable system message check box.

      2. In the box under Enable system message, type the administrative message to be displayed to users.

      3. Select the date and time for the administrative message to be displayed by using the Start Time and End Time lists.

      4. To review the message before enabling it, click Preview. Verify the message and then click OK.

    • To set a logon message:

      1. To display a logon message to users, you first need to create and save the text to be displayed to users in a separate text file.

      2. Select the Enable logon message check box.

      3. Under Enable logon message, click Browse. In the Open dialog box, select the file to display to users, and then click Open.

      4. To review the message before enabling it, click Preview. Verify the message and then click OK.

  4. To limit connections to the Remote Desktop Connection client 7.0, select the Only allow connections from Remote Desktop Services clients that support RD Gateway messaging check box.

  5. Click OK.

Additional references

  • Configuring the Remote Desktop Gateway Server

  • Checklist: Configure Remote Desktop Gateway

  • Understanding Authorization Policies for Remote Desktop Gateway

  • Open the Remote Desktop Gateway Manager


Configuring the Remote Desktop Services Client for Remote Desktop Gateway

This section provides procedures for configuring your Remote Desktop Services clients to connect to internal network resources (computers) through RD Gateway. The following topics are covered:

  • Install the Remote Desktop Gateway Server Root Certificate on the Remote Desktop Services Client

  • Configure Remote Desktop Connection Settings for Remote Desktop Gateway


Install the Remote Desktop Gateway Server Root Certificate on the Remote Desktop Services Client

The Remote Desktop Services client computer must verify and trust the identity of the RD Gateway server before the client can send the user's password and logon credentials securely and complete the authentication process. To establish this trust, the clients must trust the root of the server’s certificate. That is, clients must have the certificate of the certification authority (CA) that issued the server certificate in their Trusted Root Certification Authorities store. You can view this store by using the Certificates snap-in.

As mentioned, this procedure is not required if:

  • A certificate that is issued by one of the trusted public CAs that participate in the Microsoft Root Certificate Program Members program [as listed in article 931125 in the Microsoft Knowledge Base (http://go.microsoft.com/fwlink?LinkID=59547)] is installed on the RD Gateway server; and

  • The Remote Desktop Services client computer already trusts the issuing CA.

For more information, see Obtain a Certificate for the Remote Desktop Gateway Server.

If the RD Gateway server is using a certificate that is issued by one of the trusted public CAs, and the certificate is recognized and trusted by your client computer, proceed to complete the steps in Configure Remote Desktop Connection Settings for Remote Desktop Gateway.

Notes
  • If you are configuring the Remote Desktop Services client for use with Network Access Protection (NAP), you must install the RD Gateway server root certificate by using the computer account. If not, you can install the RD Gateway server root certificate by using the user account.
  • For more information about RD Gateway, see the Remote Desktop Services page on the Windows Server 2008 R2 TechCenter (http://go.microsoft.com/fwlink/?LinkId=140433).

Membership in the Users group or local Administrators group, or equivalent, is the minimum group membership required to complete this procedure. To open the Certificates snap-in for a computer account, membership in the local Administrators group, or equivalent, is required on the Remote Desktop Services client on which you plan to install the certificate. To open the Certificates snap-in for a user account, membership in the Users group on the client is sufficient. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To install the Remote Desktop Gateway server root certificate on the Remote Desktop Services client

  1. Open the Certificates snap-in console. If you have not already added the Certificates snap-in console, you can do so by doing the following:

    1. Click Start, click Run, type mmc and then click OK.

    2. On the File menu, click Add/Remove Snap-in.

    3. In the Add or Remove Snap-ins dialog box, in the Available snap-ins list, click Certificates, and then click Add.

    4. In the Certificates snap-in dialog box, do one of the following:

      • To open the snap-in for a computer account, click Computer account, and then click Next. In the Select Computer dialog box, click Local computer: (the computer this console is running on), and then click Finish.

      • To open the snap-in for a user account, click My user account, and then click Finish.

    5. In the Add or Remove Snap-ins dialog box, click OK.

  2. In the Certificates snap-in console, in the console tree, expand Certificates (Local Computer), expand Trusted Root Certification Authorities, right-click Certificates, point to All Tasks, and then click Import.

  3. In the Certificate Import Wizard, on the Welcome to the Certificate Import Wizard page, click Next.

  4. On the File to Import page, in the File name box, specify the name of the RD Gateway server root certificate, and then click Next.

  5. On the Certificate Store page, accept the default option Place all certificates in the following store (in the certificate store Trusted Root Certification Authorities), and then click Next.

  6. On the Completing the Certificate Import Wizard page, confirm that the following certificate settings appear:

    • Certificate Store Selected by User: Trusted Root Certification Authorities

    • Content: Certificate

    • File Name: FilePath\<Root_Certificate_Name.cer>, where <Root_Certificate_Name> is the name of the RD Gateway server root certificate.

  7. Click Finish.

  8. In the Certificate Import Wizard dialog box, click OK.

  9. With Certificates (Local Computer)\Trusted Root Certification Authorities\Certificates selected in the console tree, in the details pane, verify that the root certificate of the RD Gateway server appears in the list of certificates on the client.

Additional references

  • Configuring the Remote Desktop Services Client for Remote Desktop Gateway

  • Obtain a Certificate for the Remote Desktop Gateway Server


Configure Remote Desktop Connection Settings for Remote Desktop Gateway

Membership in the local Administrators group, or equivalent, on the RD Gateway server that you plan to configure, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To configure Remote Desktop Connection settings for Remote Desktop Gateway

  1. Open the Remote Desktop Connection client. To open the Remote Desktop Connection client, click Start, point to All Programs, point to Accessories, and then click Remote Desktop Connection.

  2. In the Remote Desktop Connection dialog box, click Options to expand the dialog box and view settings.

  3. On the Advanced tab, under Connect from anywhere, click Settings.

  4. In the RD Gateway Server Settings dialog box, select the appropriate options:

    • Automatically detect RD Gateway server settings (default). If you select this option, the Remote Desktop Services client attempts to use Group Policy settings that determine the behavior of client connections to RD Gateway servers or RD Gateway server farms, if these settings have been configured and enabled. For more information, see Using Group Policy to Manage Client Connections Through Remote Desktop Gateway.

    • Use these RD Gateway server settings. If an RD Gateway server or RD Gateway server farm name and a logon method are not already enabled and enforced by Group Policy, you can select this option and specify the name of the RD Gateway server or RD Gateway server farm that you want to connect to and the logon method to use for the connection.

      Warning

      When you specify a name for the RD Gateway server or RD Gateway server farm, you must use a fully qualified domain name (FQDN).

      Bypass RD Gateway server for local addresses. This option is selected by default.

      If you want the Remote Desktop Services client to automatically detect when RD Gateway is required, select this check box. If you use a mobile computer, selecting this option will optimize client connectivity performance and minimize latency because RD Gateway will only be used when it is required. If your computer is always connected to the local area network (LAN) or if it is hosted inside the internal network firewall, RD Gateway will not be used. If you are outside the internal network and connecting to the internal network over the Internet, RD Gateway will be used.

      Note

      If your system is on a LAN, but you want to test connectivity through an RD Gateway server or RD Gateway server farm, clear this check box. If this check box is selected, the client will connect directly to the RD Session Host server and will not connect through the RD Gateway server or RD Gateway server farm.

    • Do not use an RD Gateway server. Select this option if your computer is always connected to the LAN or if it is hosted inside the internal network firewall. This option is appropriate if you know that you do not need to use RD Gateway to traverse a firewall.

  5. Do one of the following:

    • To save the settings and close the Remote Desktop Connection dialog box, click Save, and then click Cancel. The settings will be saved as an RDP file to a default location (by default, the file is saved to Drive:\<Username>\Documents).

    • To save the RDP file to a specified location (you can customize and distribute the file later to multiple clients as needed), click Save As. In the Save As dialog box, in the File name box, specify the file name and location, and then click Save.

  6. To proceed with a connection to an internal network resource, click Connect, and then enter your credentials when prompted.

Additional references

  • Configuring the Remote Desktop Services Client for Remote Desktop Gateway


Using Group Policy to Manage Client Connections Through Remote Desktop Gateway

You can use Group Policy and Active Directory Domain Services to centralize and simplify the administration of RD Gateway policy settings. You use the Local Group Policy Editor to configure these settings, which are contained within Group Policy objects (GPOs). You use the Group Policy Management Console (GPMC) to link GPOs to sites, domains, or organizational units (OUs) in Active Directory Domain Services.

The Local Group Policy Editor operates as an extension to the GPMC. When you edit a GPO from within the GPMC, the Local Group Policy Editor appears, displaying the settings for that particular GPO. You must have edit rights on a GPO in order to open it in the Local Group Policy Editor.

The Default Domain Policy GPO and the Default Domain Controllers Policy GPO are vital to the health of any domain. As a best practice, you should not edit the Default Domain Policy GPO or the Default Domain Controllers Policy GPO, except in the following cases:

  • It is required that account policy settings be configured in the Default Domain Policy GPO.

  • If you install applications on domain controllers requiring modifications to User Rights or Audit policy settings, you must modify the policy settings in the Default Domain Controllers Policy GPO.

Group Policy settings for Remote Desktop Services client connections through RD Gateway can be applied in one of two ways. These policy settings can either be suggested (that is, they can be enabled, but not enforced) or they can be enabled and enforced.

To suggest a policy setting for RD Gateway, enable the setting in Group Policy, but do not clear the Allow users to change this setting check box. Doing this allows users on the client to enter alternate RD Gateway connection settings. To specify alternate policy settings, users select the Use these RD Gateway server settings option in the RD Gateway Server Settings dialog box on the client, and then specify the alternate RD Gateway connection settings.

To enforce a policy setting for RD Gateway, enable the setting in Group Policy and clear the Allow users to change this setting check box. When you do this, users cannot change the RD Gateway connection setting, even if they select the Use these RD Gateway server settings option on the client. For information about how to configure Remote Desktop Services client settings, see Configuring the Remote Desktop Services Client for Remote Desktop Gateway.

This section provides procedures for using Group Policy to manage Remote Desktop Services client connections to the network through RD Gateway. The following topics are covered:

  • Set the Remote Desktop Gateway Server Authentication Method

  • Enable Connections Through Remote Desktop Gateway

  • Set the Remote Desktop Gateway Server Address


Set the Remote Desktop Gateway Server Authentication Method

This procedure describes how to use the Group Policy Management Console (GPMC) to set an authentication method for Remote Desktop Services clients that connect to internal network resources (computers) through an RD Gateway server.

Note

To manage Group Policy on a Windows Server 2008 R2-based domain controller, you must first add the Group Policy Management Console feature. To do this, start Server Manager, and then under Feature Summary, click Add Features. On the Select Features page, select the Group Policy Management check box. Follow the on-screen instructions to complete the installation.

To change Group Policy settings for a domain or an organizational unit (OU), you must be logged on as a member of the Domain Admins, Enterprise Admins, or the Group Policy Creator Owners group, or have been delegated the appropriate control over Group Policy.

To set the Remote Desktop Gateway server authentication method

  1. Start the GPMC. To do so, click Start, point to Administrative Tools, and then click Group Policy Management.

  2. In the left pane, locate the OU that you want to edit.

    • To modify an existing Group Policy object (GPO) for the OU, expand the OU, and then click the GPO.

    • To create a new GPO, follow these steps:

      1. Right-click the OU, and then click Create a GPO in this domain, and link it here.

      2. In the Name box, type a name for the GPO, and then click OK.

      3. In the left pane, locate and click the new GPO.

  3. In the right pane, click the Settings tab.

  4. Right click User Configuration, and then click Edit.

  5. In the left pane, under User Configuration, expand Policies, expand Administrative Templates, expand Windows Components, expand Remote Desktop Services, and then click RD Gateway.

  6. In the right pane, in the settings list, right-click Set RD Gateway authentication method, and then click Edit.

  7. In the Set RD Gateway authentication method dialog box, do one of the following:

    • Click Not Configured. The authentication method that is specified by the user is used. If an authentication method is not specified, the NTLM protocol that is enabled on the client or a smart card can be used for authentication.

    • Click Enabled, and then select the authentication method. By default, the Allow users to change this setting check box is not selected, meaning that the authentication method setting is suggested, and that users on the Remote Desktop Services client will be unable to specify an alternate authentication method. To allow the authentication method to be revised by users on the client, select this check box. For information about supported Windows authentication methods for RD Gateway, see Understanding Requirements for Connecting to a Remote Desktop Gateway Server.

    • Click Disabled. The authentication method that is specified by the user is used. If an authentication method is not specified, the NTLM protocol that is enabled on the Remote Desktop Services client or a smart card can be used for authentication.

  8. Click OK.
Note

To configure RD Gateway settings by using the local computer policy, use the Local Group Policy Editor. To start the Local Group Policy Editor, click Start, click Run, type gpedit.msc, and then click OK. To configure local Group Policy settings, you must be a member of the Administrators group on the local computer or you must have been delegated the appropriate authority.

Additional references

  • Using Group Policy to Manage Client Connections Through Remote Desktop Gateway

  • Checklist: Configure Remote Desktop Gateway


Enable Connections Through Remote Desktop Gateway

This procedure describes how to use the Group Policy Management Console (GPMC) to enable connections through RD Gateway. When this policy setting is enabled, when Remote Desktop Services clients cannot connect directly to an internal network resource (computer), the clients will attempt to connect to the computer through the RD Gateway server that is specified in the Set RD Gateway server address policy setting.

Note

To manage Group Policy on a Windows Server 2008 R2-based domain controller, you must first add the Group Policy Management Console feature. To do this, start Server Manager, and then under Feature Summary, click Add Features. On the Select Features page, select the Group Policy Management check box. Follow the on-screen instructions to complete the installation.

To change Group Policy settings for a domain or an organizational unit (OU), you must be logged on as a member of the Domain Admins, Enterprise Admins, or the Group Policy Creator Owners group, or have been delegated the appropriate control over Group Policy.

To enable connections through RD Gateway

  1. Start the GPMC. To do so, click Start, point to Administrative Tools, and then click Group Policy Management.

  2. In the left pane, locate the OU that you want to edit.

    • To modify an existing Group Policy object (GPO) for the OU, expand the OU, and then click the GPO.

    • To create a new GPO, follow these steps:

      1. Right-click the OU, and then click Create a GPO in this domain, and link it here.

      2. In the Name box, type a name for the GPO, and then click OK.

      3. In the left pane, locate and click the new GPO.

  3. In the right pane, click the Settings tab.

  4. Right click User Configuration, and then click Edit.

  5. In the left pane, under User Configuration, expand Administrative Templates, expand Windows Components, expand Remote Desktop Services, and then click RD Gateway.

  6. In the right pane, in the settings list, right-click Enable connection through RD Gateway, and then click Edit.

  7. On the Settings tab, do one of the following:

    • Click Not Configured. Remote Desktop Services clients will not use the RD Gateway server address that is specified in the Set RD Gateway server address policy setting. If an RD Gateway server is specified by the user, a client connection attempt will be made through that RD Gateway server.

    • Click Enabled. When Remote Desktop Services clients cannot connect directly to an internal network resource, the clients will attempt to connect to the internal network resource through the RD Gateway server that is specified in the Set RD Gateway server address policy setting.

    • Click Disabled. Remote Desktop Services clients will not use the RD Gateway server address that is specified in the Set RD Gateway server address policy setting. If an RD Gateway server is specified by the user, a client connection attempt will be made through that RD Gateway server.

  8. Click OK.
Note

To configure RD Gateway settings by using the local computer policy, use the Local Group Policy Editor. To start the Local Group Policy Editor, click Start, click Run, type gpedit.msc and then click OK. To configure local Group Policy settings, you must be a member of the Administrators group on the local computer or you must have been delegated the appropriate authority.

Additional references

  • Using Group Policy to Manage Client Connections Through Remote Desktop Gateway

  • Checklist: Configure Remote Desktop Gateway


Set the Remote Desktop Gateway Server Address

This procedure describes how to use the Group Policy Management Console (GPMC) to specify the RD Gateway server that Remote Desktop Services clients use when connecting to internal network resources (computers) through an RD Gateway server.

By default, Remote Desktop Services clients automatically detect when RD Gateway is required.

Note

To manage Group Policy on a Windows Server 2008 R2-based domain controller, you must first add the Group Policy Management Console feature. To do this, start Server Manager, and then under Feature Summary, click Add Features. On the Select Features page, select the Group Policy Management check box. Follow the on-screen instructions to complete the installation.

To change Group Policy settings for a domain or an organizational unit (OU), you must be logged on as a member of the Domain Admins, Enterprise Admins, or the Group Policy Creator Owners group, or have been delegated the appropriate control over Group Policy.

To set the Remote Desktop Gateway server address

  1. Start the GPMC. To do so, click Start, point to Administrative Tools, and then click Group Policy Management.

  2. In the left pane, locate the OU that you want to edit.

    • To modify an existing Group Policy object (GPO) for the OU, expand the OU, and then click the GPO.

    • To create a new GPO, follow these steps:

      1. Right-click the OU, and then click Create a GPO in this domain, and link it here.

      2. In the Name box, type a name for the GPO, and then click OK.

      3. In the left pane, locate and click the new GPO.

  3. In the right pane, click the Settings tab.

  4. Right click User Configuration, and then click Edit.

  5. In the left pane, under User Configuration, expand Administrative Templates, expand Windows Components, expand Remote Desktop Services, and then click RD Gateway.

  6. In the right pane, in the list of settings, right-click Set RD Gateway server address, and then click Properties.

  7. On the Settings tab, do one of the following:

    • Click Not Configured. Remote Desktop Services clients automatically detect when RD Gateway is required. When a connection through RD Gateway is required, the RD Gateway server or RD Gateway server farm specified by the user is used.

    • Click Enabled, and then specify a valid, fully qualified domain name (FQDN) of the RD Gateway server or RD Gateway server farm that clients are to use when connecting to internal network resources. The name must match the name that appears in the Secure Sockets Layer (SSL) certificate for the RD Gateway server.

      By default, the Allow users to change this setting check box is selected, meaning that this setting is suggested, and users can specify an alternate RD Gateway server or RD Gateway server farm. To enforce this setting so that users cannot specify an alternate RD Gateway server or RD Gateway farm, clear this check box.

    • Click Disabled. Remote Desktop Services clients automatically detect when RD Gateway is required.

      Important

      If you disable or do not configure this policy setting, but enable the Enable connections through RD Gateway policy setting, client connection attempts to any internal network resource will fail, if the client cannot connect directly to the internal network resource.

  8. Click OK.
Note

To configure RD Gateway settings by using the local computer policy, use the Local Group Policy Editor. To start the Local Group Policy Editor, click Start, click Run, type gpedit.msc and then click OK. To configure local Group Policy settings, you must be a member of the Administrators group on the local computer or you must have been delegated the appropriate authority.

Additional references

  • Using Group Policy to Manage Client Connections Through Remote Desktop Gateway

  • Checklist: Configure Remote Desktop Gateway


Monitoring a Remote Desktop Gateway Server for Connection Status and Reporting

This section provides procedures for monitoring active connections from Remote Desktop Services clients to internal network resources (computers) through an RD Gateway server. The following topics are covered:

  • Specify Remote Desktop Gateway Events to Log

  • View Details About Active Connections Through a Remote Desktop Gateway Server

  • Understanding Details About Active Connections Through a Remote Desktop Gateway Server

  • Modify the Refresh Interval for Displaying Remote Desktop Gateway Connection Information


Specify Remote Desktop Gateway Events to Log

By using Remote Desktop Gateway Manager, you can specify the types of events that you want to monitor, such as unsuccessful or successful connection attempts to internal network resources (computers) through an RD Gateway server.

When these events occur, you can monitor the corresponding events by using Windows Event Viewer. RD Gateway server events are stored in Event Viewer under Application and Services Logs\Microsoft\Windows\Terminal Services-Gateway\.

Membership in the local Administrators group, or equivalent, on the RD Gateway server that you plan to configure, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To specify Remote Desktop Gateway events to log

  1. On the RD Gateway server, open Remote Desktop Gateway Manager. To open Remote Desktop Gateway Manager, click Start, point to Administrative Tools, point to Remote Desktop Services, and then click Remote Desktop Gateway Manager.

  2. In the Remote Desktop Gateway Manager console tree, right-click the local RD Gateway server, and then click Properties.

  3. On the Auditing tab, select or clear the appropriate check boxes to specify the events that you want to monitor for RD Gateway.

  4. Click OK.

Additional references

  • Monitoring a Remote Desktop Gateway Server for Connection Status and Reporting

  • Open the Remote Desktop Gateway Manager


View Details About Active Connections Through a Remote Desktop Gateway Server

You can use Remote Desktop Gateway Manager to view information about active connections from Remote Desktop Services clients to internal network resources (computers) through RD Gateway. For more information about the details that are displayed for active connections, see Understanding Details About Active Connections Through a Remote Desktop Gateway Server.

Membership in the local Administrators group, or equivalent, on the RD Gateway server that you plan to configure, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To view details about active connections through a Remote Desktop Gateway server

  1. On the RD Gateway server, open Remote Desktop Gateway Manager. To open Remote Desktop Gateway Manager, click Start, point to Administrative Tools, point to Remote Desktop Services, and then click Remote Desktop Gateway Manager.

  2. In the Remote Desktop Gateway Manager console tree, click to expand the node that represents your RD Gateway server, which is named for the computer on which the RD Gateway server is running.

  3. In the console tree, click Monitoring.

    The Remote Desktop Gateway Manager results pane displays a summary of the number of connections from remote users to computers on the internal network. Specific connections, if any, are listed below the summary.

    When you click a connection, the connection details appear in the lower pane. If necessary, you can disconnect a specific connection or all RD Gateway connections for a user.

  4. To refresh the display of connection status, in the Actions pane, click Refresh.

Additional references

  • Monitoring a Remote Desktop Gateway Server for Connection Status and Reporting

  • Open the Remote Desktop Gateway Manager


Understanding Details About Active Connections Through a Remote Desktop Gateway Server

You can use Remote Desktop Gateway Manager to view information about active connections from Remote Desktop Services clients to internal network resources (computers) through an RD Gateway server. This information is displayed in the Monitoring details pane.

The following table lists and describes the information that is displayed about active connections.

Event name Description

Connection ID

In the format <a:b> where "a" is the tunnel ID that uniquely identifies a specific connection to the RD Gateway server and "b" is the channel ID. The tunnel ID represents the number of connections that the RD Gateway server has received since the Remote Desktop Services Gateway service has been running. Each time the RD Gateway server receives a new connection, the tunnel ID is incremented by 1.

User ID

The domain and user ID of the user logged on to the client, in the format <domain\userID>.

User Name

The full name of the user logged on to the client.

Connected On

The date and time when the connection was initiated.

Connection Duration

The length of time that the connection was active.

Idle Time

The length of time that the connection is idle, if applicable.

Target Computer

The name of the internal network computer to which the client is connected.

Client IP Address

The IP address of the client.

Note

If your network configuration includes proxy servers, the IP address that appears in this column will reflect the IP address of the proxy server, rather than the IP address of the Remote Desktop Services client.

Target Port

The port on the internal network computer to which the client is connected.

Additional references

  • Monitoring a Remote Desktop Gateway Server for Connection Status and Reporting

  • View Details About Active Connections Through a Remote Desktop Gateway Server


Modify the Refresh Interval for Displaying Remote Desktop Gateway Connection Information

By default, the display of RD Gateway connection status is refreshed automatically every 30 minutes. You can modify the refresh interval or specify that the display of this information not be refreshed automatically.

Important

Setting the refresh interval to a value of less than 10 minutes can adversely impact the performance of the RD Gateway server.

Membership in the local Administrators group, or equivalent, on the RD Gateway server that you plan to configure, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To modify the refresh interval for displaying Remote Desktop Gateway connection information

  1. On the RD Gateway server, open Remote Desktop Gateway Manager. To open Remote Desktop Gateway Manager, click Start, point to Administrative Tools, point to Remote Desktop Services, and then click Remote Desktop Gateway Manager.

  2. In the Remote Desktop Gateway Manager console tree, click to expand the node that represents your RD Gateway server, which is named for the computer on which the RD Gateway server is running.

  3. In the console tree, right-click the Monitoring folder, and then click Set Automatic Refresh Options.

  4. In the Set Automatic Refresh Options dialog box, do either of the following:

    • To specify that the display of RD Gateway connection information not be refreshed automatically, click Do not refresh automatically.

    • To specify that the display of RD Gateway connection information be refreshed automatically, click Refresh automatically, and then specify a value as needed.

  5. Click OK.

Additional references

  • Monitoring a Remote Desktop Gateway Server for Connection Status and Reporting

  • Open the Remote Desktop Gateway Manager


Enable or Disable Credential Sharing for Connections Through Remote Desktop Gateway

For users to connect to internal network resources (computers) through RD Gateway, two levels of authentication are required. The first level of authentication must occur successfully for users to connect to the RD Gateway server. The second level of authentication must occur successfully for users to connect to remote computers (internal network computers). For each level of authentication, users are prompted for credentials, unless one or more of the following credentials are available to the users:

  • Locally-logged on credentials

  • Saved credentials

  • Shared credentials

Note

Credential sharing is available with the Remote Desktop Connection (RDC) 6.1 client. RDC 6.1 supports Remote Desktop Protocol 6.1.

When credential sharing is enabled, users can enter the same set of credentials for authenticating to both the RD Gateway server and the remote computer. In this case, the user is prompted to provide credentials only once.

By default, credential sharing is enabled for RD Gateway, but you can disable credential sharing if the security policies of your organization require that you do so. You can enable or disable credential sharing in either of the following two ways:

  • Editing connection settings on the Remote Desktop Services client (Remote Desktop Connection). On the client, the credential sharing setting is configured by selecting or clearing the Use my RD Gateway credentials for the remote computer check box, as described later in this topic.

  • Editing RDP file settings. In the RDP file, the credential sharing setting is configured by adding or modifying the PromptCredentialOnce:i line, as described later in this topic.

If credential sharing is enabled, when users attempt to connect to a computer through RD Gateway, a Windows Security dialog box appears that prompts users once for credentials and informs them that the credentials that they provide will be used to connect to both the RD Gateway server and the remote computer (the internal network computer). The names of both computers are noted in the Windows Security dialog box.

The Windows Security dialog box also includes the Remember my credentials check box. If users select this check box after they supply their credentials, their credentials will be saved both for the RD Gateway server and the remote computer. The same credentials will be used in subsequent connections to the same RD Gateway server and remote computer.

Important
  • The Remember my credentials setting is ignored in either of the following cases: if users have already saved their credentials, or if the Group Policy setting to allow users to specify their locally logged-on credentials for RD Gateway is enabled.
  • When users have saved their credentials, during their next connection attempt to the same RD Gateway server and remote computer, a message will appear in the RD Gateway Server Settings dialog box on the client stating that the saved credentials will be used to connect to the RD Gateway server. Users can edit or delete these credentials. (To open the RD Gateway Server Settings dialog box, on the client computer, in the Remote Desktop Connection dialog box, click Options, and then on the Advanced tab, in the Connect from anywhere area, click Settings.)
  • If you have enabled the Group Policy setting to allow users to specify their locally-logged on credentials for RD Gateway, when the user attempts the connection, a message will appear in the RD Gateway Server Settings dialog box that states that the credentials of the currently logged on user will be used to connect to the RD Gateway server. For information about how to enable the Group Policy setting to allow the use of locally-logged on credentials for RD Gateway, see Set the Remote Desktop Gateway Server Authentication Method.

Membership in the local Administrators group, or equivalent, on the RD Gateway server that you plan to configure, is the minimum required to complete this procedure.

To edit client settings to enable or disable credential sharing

  1. Open the Remote Desktop Connection client. To open the Remote Desktop Connection client, click Start, point to All Programs, point to Accessories, and then click Remote Desktop Connection.

  2. In the Remote Desktop Connection dialog box, click Options to expand the dialog box and view settings.

  3. On the Advanced tab, in the Connect from anywhere area, click Settings.

  4. In the RD Gateway Server Settings dialog box, in the Logon settings area, select the Use my RD Gateway credentials for the remote computer check box.

  5. Verify and configure additional client connection settings for RD Gateway as needed, and then click OK to close the dialog box. For information about how to configure additional client settings, see Configure Remote Desktop Connection Settings for Remote Desktop Gateway.

  6. Do one of the following:

    • To save the settings and close the Remote Desktop Connection dialog box, on the General tab, click Save, and then click Cancel. The settings will be saved as an RDP file to a default location (by default, the file is saved to Drive:\<Username>\Documents).

    • To save the RDP file to a specified location (you can customize and distribute the file later to multiple clients as needed), click Save As. In the Save As dialog box, in the File name box, specify the file name and location, and then click Save.

  7. To proceed with a connection to an internal network resource, on the General tab, configure the settings under Logon settings as needed, click Save, click Connect, and then enter your credentials when prompted.

Alternatively, as mentioned, you can edit settings directly in the RDP file.

To edit an RDP file to enable or disable credential sharing

  1. Open the RDP file that you want to edit by using a text editor, such as Notepad.

  2. Do one of the following:

    • To disable credential sharing, add the following line (or ensure that any existing PromptCredentialOnce:i line appears as follows): PromptCredentialOnce:i:0

    • To re-enable credential sharing, edit the PromptCredentialOnce:i line so that it appears as follows: PromptCredentialOnce:i:1

  3. Save and then close the file.

Additional references

  • Configure Remote Desktop Connection Settings for Remote Desktop Gateway


Specify Conditions That Users Must Meet to Connect to an RD Gateway Server

Remote Desktop connection authorization policies (RD CAPs) allow you to specify who can connect to an RD Gateway server.

Important

If you have not done so already, you must also create a Remote Desktop resource authorization policy (RD RAP). Until you create both an RD CAP and an RD RAP, users cannot connect to network resources through this RD Gateway server.

Membership in the local Administrators group, or equivalent, on the RD Gateway server that you plan to configure, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To specify conditions that users must meet to connect to an RD Gateway server

  1. On the RD Gateway server, open Remote Desktop Gateway Manager. To open Remote Desktop Gateway Manager, click Start, point to Administrative Tools, point to Remote Desktop Services, and then click Remote Desktop Gateway Manager.

  2. In the Remote Desktop Gateway Manager console tree, click to select the node that represents the RD Gateway server, which is named for the computer on which the RD Gateway server is running.

  3. In the console tree, expand Policies, and then click Connection Authorization Policies.

  4. In the results pane, right-click the RD CAP for which you want to specify conditions, and then click Properties.

  5. On the Requirements tab, under Supported Windows authentication methods, select one or both of the following check boxes:

    • Password

    • Smart card

    When both of these options are selected, clients that use either authentication method are allowed to connect. For information about supported Windows authentication methods for RD Gateway, see Understanding Requirements for Connecting to a Remote Desktop Gateway Server.

  6. Under User group membership (required), click Add Group, and then specify a user group whose members can connect to the RD Gateway server. You must specify at least one user group.

  7. In the Select Groups dialog box, specify the user group location and name, and then click OK as needed to check the name and to close the Select Groups dialog box. To specify more than one user group, do either of the following:

    • Type the name of each user group, separating the name of each group with a semi-colon.

    • Add additional groups from different domains by repeating step 7 for each group.

  8. To specify computer domain membership criteria that client computers should meet (optional), on the Requirements tab, under Client computer group membership (optional), click Add Group, and then specify the computer groups.

    To specify the computer groups, you can use the same steps that you used to specify user groups.

  9. Click OK as needed to close the Properties dialog box for the RD CAP.

Additional references

  • Manage Remote Desktop Connection Authorization Policies (RD CAPs)

  • Checklist: Configure Remote Desktop Gateway

  • Understanding Authorization Policies for Remote Desktop Gateway

  • Open the Remote Desktop Gateway Manager


Understand Timeout and Reconnection Settings for Remote Sessions

Timeouts can be set on the RD Gateway server for Remote Desktop Services clients. Timeouts can be used to reclaim resources from inactive user sessions or periodically enforce policies on active user connections for Remote Desktop Services clients connected by using an RD Gateway server.

Remote Desktop Gateway timeouts

The following timeouts can be set on the Timeouts tab of the Properties dialog box for a Remote Desktop connection authorization policy (RD CAP) for the RD Gateway server.

  1. Enable idle timeout is used to reclaim resources from inactive user sessions without impacting the user’s session and data. When the idle timeout is reached, the session is disconnected and resources from the session are reclaimed by the RD Gateway server.

  2. Enable session timeout is used to periodically enforce policies on active user connections. When the session timeout is reached, the session can be disconnected, or the session can be reauthenticated and reauthorized with no impact to the user and their session if no policy changes have been made.

Additional references

  • Create an RD CAP

  • Manage Remote Desktop Connection Authorization Policies (RD CAPs)

  • Checklist: Configure Remote Desktop Gateway

  • Open the Remote Desktop Gateway Manager


What Is Device Redirection?

Remote Desktop Services provides client users the ability to access their local devices and resources in remote sessions. Users can access resources such as local drives, printers, the Clipboard, and supported Plug and Play devices. This is usually referred to as device redirection.

In Windows Server 2008 R2, device redirection has been enhanced and expanded. Now you can redirect Windows Portable Devices, specifically media players based on the Media Transfer Protocol (MTP), and digital cameras based on the Picture Transfer Protocol (PTP).

For RD Gateway, when you select the option to disable device redirection for specific device types, the RD Gateway server will send the request back to the client with a list of the device types to be disabled. This list is a suggestion only; it is possible for the client to modify the device redirection settings in the list. The suggested device redirection settings can only be enforced for Remote Desktop Connection (RDC) clients.

Caution

Selecting the Only allow client connections to Remote Desktop Session Host servers that enforce RD Gateway device redirection check box will prevent users that are running versions older than Remote Desktop Connection (RDC) 7.0 from connecting, and will enforce secure device redirection.

Note

RD Gateway does not have the ability to manage device redirection for smart cards and audio.

For more information about device redirection in Windows Server 2008 R2, see the Remote Desktop Services page on the Windows Server 2008 R2 TechCenter (http://go.microsoft.com/fwlink/?LinkId=140433).

Additional references

  • Enable or Disable Client Device Redirection


Enable or Disable Client Device Redirection

Remote Desktop connection authorization policies (RD CAPs) allow you to specify who can connect to an RD Gateway server. You can specify a user group that exists on the local RD Gateway server or in Active Directory Domain Services. Users are granted access to an RD Gateway server if they meet the conditions specified in the RD CAP.

Membership in the local Administrators group, or equivalent, on the RD Gateway server that you plan to configure, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To enable or disable client device redirection

  1. On the RD Gateway server, open Remote Desktop Gateway Manager. To open Remote Desktop Gateway Manager, click Start, point to Administrative Tools, point to Remote Desktop Services, and then click Remote Desktop Gateway Manager.

  2. In the Remote Desktop Gateway Manager console tree, click to expand the node that represents the RD Gateway server, which is named for the computer on which the RD Gateway server is running.

  3. In the console tree, expand Policies, and then click Connection Authorization Policies.

  4. In the results pane, right-click the RD CAP for which you want to enable or disable client device redirection, and then click Properties.

  5. On the Device Redirection tab, select one of the following options to enable or disable redirection for remote client devices:

    • To permit all client devices to be redirected when connecting through the RD Gateway server, click Enable device redirection for all client devices. By default, this option is selected.

    • To disable device redirection for only certain device types when connecting through the RD Gateway server, click Disable device redirection for the following client device types, and then select the check boxes that correspond to the client device types for which device redirection should be disabled.

  6. To only allow client connection to servers that enforce secure device redirection, on the Device Redirection tab, select the Only allow client connections to Remote Desktop Session Host servers that enforce RD Gateway device redirection check box.

  7. Click OK.

Additional references

  • Manage Remote Desktop Connection Authorization Policies (RD CAPs)

  • Checklist: Configure Remote Desktop Gateway

  • Understanding Authorization Policies for Remote Desktop Gateway

  • Open the Remote Desktop Gateway Manager