Enforce Strong Authentication for Remote Desktop Services

Remote Desktop Web Access is a web application that provides access to remote applications through Remote Desktop Protocol (RDP) files. These files contain information necessary to successfully establish a remote connection (e.g. the remote IP address). With Digipass Authentication for Remote Desktop Web Access, authentication to Remote Desktop Web Access can take place only with OTPs.

To ensure strong authentication also for Remote Desktop Client, there are two options:

1. If you have access to the client workstations, you can either install Digipass Authentication for Windows Logon (DAWL) on the client workstation, or use and configure Remote Desktop Gateway (RD Gateway). For more information about DAWL, refer to the DAWL product documentation.

2. If you do not have access to the client workstations, you need to use Remote Desktop Gateway (RD Gateway).

Set up Remote Desktop Gateway with Digipass Authentication for Remote Desktop Web Access

To prevent direct contact with the Remote Desktop Session Host and ensure strong authentication, you need to incorporate the Digipass Authentication for Remote Desktop Web Access in a Remote Desktop Web Access environment that includes the following:

• Remote Desktop Gateway (RD Gateway)

• An additional firewall and/or network security solution that supports the filtering of requests to RD Gateway, and that does not include a session cookie.

With RD Gateway, remote connections from Remote Desktop Web Access and the local Remote Desktop Client can be routed through a secure channel. Remote connections outside this channel are not permitted.

To enforce strong authentication through Digipass Authentication for Remote Desktop Web Access, you need to configure the firewall and/or network security solution accordingly. Connection requests must be allowed only through RD Gateway if a session cookie from the Remote Desktop Web site exists. Because connections can only go through RD Gateway, and the session cookie is required, users can access remote applications only via Remote Desktop Web Access. In addition, users must authenticate to Remote Desktop Web Access via Digipass Authentication for Remote Desktop Web Access. Thus, remote connections from the local Remote Desktop Client, which circumvent strong authentication with OTPs, are no longer possible.

For more information about setting up Remote Desktop Gateway, refer to https://docs.microsoft.com/en-us/windows-server/remote/remote-desktop-services/clients/remote-desktop-clients.