RDP Proxy Configuration

Overview

The RDP Proxying feature allows RDP connections, established using a launcher, to be routed through Secret Server. You can set it up one of two ways:

• Recommended method: The launcher connects to the newer RDP proxy with temporary credentials, and the RDP proxy connects to the remote server using the protected credentials from the secret. This method is preferred because it prevents the secret credentials from reaching the client machine. For this method, you simply configure the RDP proxy.
• Alternative method: The launcher uses an SSH proxy to tunnel a local RDP connection to a remote server. This method does not protect the credential from reaching the client machine. For this method you configure the SSH proxy and enable SSH tunneling.

These two approaches to RDP proxying are not compatible—you may use one or the other but not both. We performance tested both methods. Either can support 100 concurrent connections.

Recommended Method

How It Works

1. The user clicks the RDP launcher in Secret Server.

2. The launcher executes on the client's machine.

3. The launcher establishes a connection to the RDP Proxy using credentials generated for the session.

   These credentials are short-lived and can only be used within a 15-minute window. To support reconnects in keeping with the RDP protocol, the window resets upon reconnect.

4. Once the launcher has successfully authenticated with the RDP proxy, the RDP proxy looks up the credentials and target hostname to connect to.

   The secret credentials do not get served to the client machine in this flow, which improves credential security.

5. The RDP proxy connects to the desired remote host with the secret credentials.

6. The RDP session is established.

7. RDP traffic is sent back and forth over the RDP proxy, session keystrokes are monitored if session recording is enabled.

Enable the RDP Proxy

1. Navigate to Admin > Proxying.
2. Click the RDP Proxy tab.
3. Click Edit next to Enable RDP proxy and set it to Yes.
4. Click Save.
5. Click the Endpoints tab and confirm each participating node, site, and engine is configured for RDP proxying.

Enable RDP Gateway mode

Gateway mode tunnels RDP over HTTPS using the MS-TSGU protocol. It is configured on the same page as direct RDP Proxy and can also be overridden per-site and per-engine. See Per-site and per-engine overrides below.

Procedure:

1. Navigate to Admin > Proxying > RDP Proxy.
2. Confirm Enable RDP proxy is Yes.
3. Click Edit next to Enable RDP Gateway and set it to Yes.
4. Click Edit next to RDP Gateway port and enter the listener port. The default is 8443. This sets the global value, which you can override per site or per engine. See RDP Proxy Configuration.
5. Under RDP server certificate, confirm the selected certificate matches the hostname clients will use to reach the gateway. See RDP Proxy Certificate Options.
6. Click Save.

Settings Reference

The Scope column shows where each setting can be configured. A global value is set on Admin > Proxying > RDP Proxy. Settings marked per-site or per-engine can also be overridden at that level. See RDP Proxy Configuration.

Setting	Scope	Description
Enable RDP proxy	Global, per-site, per-engine	Controls whether the RDP proxy feature is active. When set to No, neither direct nor gateway mode is available.
RDP proxy port	Global, per-site, per-engine	Sets the TCP port on which the direct RDP proxy listens. Default: 3390.
Enable RDP Gateway	Global, per-site, per-engine	Controls whether the MS-TSGU gateway listener is active. Requires Enable RDP proxy to also be Yes.
RDP Gateway port	Global, per-site, per-engine	Sets the TCP port on which the gateway listens. Default: 8443. Must differ from the RDP proxy port.
Validate remote certificates	Global	Determines whether the proxy drops the target-side connection if the target certificate fails SSL validation.
Allow AD site selection (SSH and RDP)	Global	Allows site selection at launch time for Active Directory secrets.
Proxy new secrets by default	Global	Sets proxying to enabled by default on newly created SSH and RDP secrets.
SSPI authentication method	Global	Selects the authentication method the proxy uses when it connects to target hosts. Negotiate is the default. This setting applies only to the proxy-to-target connection. It has no effect on how clients authenticate to the proxy (NTLMv2 in direct mode) or to the gateway (bearer token). See RDP Proxy Technical Notes.
Days to Keep Operational Logs	Global	Sets the retention period for RDP proxy operational log entries.
RDP server certificate	Global, per-site, per-engine	Selects the certificate the proxy presents to connecting clients. Site and engine overrides use the RDP Proxy Certificate field. See RDP Proxy Certificate Options.

Per-Site and Per-Engine Overrides

The enable toggles, listener ports, and certificate can be overridden per distributed engine site and per individual engine. The Scope column in the RDP Proxy Configuration shows which settings support overrides. Overrides are optional—any value not set at a lower level inherits from the level above.

Resolution order, highest precedence first:

1. Engine override, configured in the Default engine settings modal on the site detail page.
2. Site override, configured in the site edit modal.
3. Global value, configured on this page.

Per-Site Overrides

On the site's edit modal, the RDP Proxy section contains override fields for Enable RDP proxy, RDP proxy port, Enable RDP Gateway, RDP Gateway port, and RDP Proxy Certificate. Each port field pairs with an Inherited checkbox. Check it to inherit the global value, and uncheck it to enter a site-specific value. To override the certificate, select a Secret of the PFX template; leave blank to inherit the global RDP server certificate. The same modal opens from the Admin > Proxying > Endpoints page. See RDP Proxy Configuration.

Per-Engine Overrides

Per-engine overrides are set in the Default engine settings modal accessed from a site's detail page. The modal exposes RDP Proxy and RDP Gateway toggles, and the Advanced site configuration section lists the corresponding port and certificate overrides.

See Distributed Engine Configuration and Sizing.

Monitoring and Editing Effective Settings

The Admin > Proxying > Endpoints page summarizes the effective ports and enable state for each site and engine after overrides resolve.

The Endpoints page is also an edit surface. From it you can edit a site's RDP proxy overrides, including Enable RDP Gateway and the RDP Proxy Certificate picker, using the same site edit modal that opens from Admin > Distributed Engine > Sites. The certificate is optional. Leave it empty to inherit the global RDP server certificate.

Alternative Method

How It Works

1. The user clicks the RDP launcher in Secret Server.

2. The launcher executes on the client's machine.

3. The launcher establishes a connection to the SSH proxy to begin port forwarding.

4. The launcher authenticates with the SSH Proxy.

5. The launcher opens a socket.

6. The launcher listens for a connection on an available ephemeral port (the forwarding port) on the client's machine.

7. RDP launches on the client machine using the secret credentials and connects locally to the forwarding port.

8. All RDP traffic for this session is routed through the SSH tunnel to Secret Server, then forwarded to the target machine.

9. The RDP session is established.

Configuration

1. Navigate to the Admin > SSH Proxy.

2. Enable the Tunnel RDP connections option. If enabled, RDP launchers will tunnel through a SSH Proxy if possible. This option predates the RDP Proxy which is now recommended instead.

3. Click the Endpoints tab to ensure that your server nodes, sites, and engines are properly configured.

4. Proxied RDP secrets now launch into the SSH proxy using local port forwarding.

Known Issues

Port Conflicts

If an distributed engine is installed on the Secret Server web node and both are running RDP Proxy on the same port, this causes issues. The RDP Proxy port (default 3390) and the RDP Gateway port (default 8443) should not conflict with native RDP (3389), each other, or other services.

Self-Connection Limitations

Loop backs can introduce intermittent connectivity issues via errant edge-case handshakes, especially if ports or firewall rules are not properly configured. See the following section.

Network and Certificate Requirements

The configuration requires proper CredSSP support, NTLMv2 authentication, Network Level Authentication, and certificate validation between the proxy machine and target.

"Could not load file or assembly..." Error

Error appears in Secret Server.log or DE.log. Install the most recent version of the .NET Framework to correct it.

RDP Proxy Does Not Work with FIPS Validation

RDP proxy does not work on machines the have the FIPS validation security policy active. No fix is currently available.

Setting Notes

Changes to "Enable RDP Gateway," "RDP Gateway Port," and the RDP server certificate are picked up by the Secret Server local site immediately on save. Distributed engines detect the change on their next heartbeat (typically within 30 seconds) and restart their RDP proxy listeners with the new settings. No iisreset or engine service restart is required.