Duo RDP: Two-Factor Authentication for RD Web and RD Gateway

To protect both the Remote Desktop (RD) Web and RD Gateway roles on the same server, you can install Duo Authentication for RD Web onto a server hosting both roles. However, after completing installation, only the RD Web portal will be protected with Duo two-factor authentication.

The process of installing Duo Authentication for RD Web is straightforward: simply install it onto your RD Web server. Once installed, users who proceed to the RemoteApp and Desktop Connection web console will see any published RemoteApp programs and virtual desktops. Downloaded RDP files can also be saved for reuse, without requiring two-factor authentication from RD Web at launch.

After primary login to the RD Web portal, remote users receive the Duo enrollment or authentication page. This means that in this scenario, Duo protects logons via browser to the RD Web portal only. For more information on setting up Duo Authentication for Remote Desktop Web and Remote Desktop Gateway 2012 and later instructions, refer to the official documentation.

In a typical deployment, you may choose to install Duo Authentication for RD Web onto your RD Web servers, and then install it onto your RD Gateway servers separately. This allows you to protect logons via browser to the RD Web portal, as well as logons via local RDP client and RemoteApp and Desktop Connections from the local system to an RD Gateway server.

It's also important to note that connecting to a computer directly from RD Web using the 'Connect to a remote PC' feature with RD Gateway authentication is permitted. In this scenario, users will be presented with the Duo enrollment or authentication page after primary authentication, ensuring that two-factor authentication is enforced for all logons.

To mitigate the potential for bypassing two-factor authentication, it's recommended to block direct RDP access to these hosts. This can help prevent unauthorized access to your RD Connection Broker and/or Session Hosts.

If you want to enforce two-factor authentication for all clients, ensure that they must connect through RD Web Access with Duo and/or RD Gateway with Duo. By following these best practices, you can effectively protect your remote desktop infrastructure with Duo RDP.

Duo rdp