Add an RDP Server
Last modified on February 18, 2025
An Remote Desktop Protocol (RDP) Server in StrongDM is the combination of an IP/DNS address and authentication information used to control a Microsoft Windows resource, such as a server running Windows Server 2019 or Windows 10 Professional. This guide will show you how to add an RDP Server as a resource in the Admin UI. If you intend to use certificate authentication, you should see the section for the RDP (Certificate Authentication) resource type.
Limitations
- For Windows users, StrongDM supports the Microsoft Terminal Services Client (MSTSC) that comes bundled with Windows, but does not fully support the Remote Desktop app on the Windows Store. It is recommended if you are using MSTSC that you use StrongDM CLI 45.88.0 or higher, as a change introduced by the Windows 11 2024 Update caused a temporary incompatibility prior to this CLI version.
- StrongDM only supports NTLM authentication for RDP resources. If the user account used to set up the RDP resource in StrongDM is added to the “Protected Users” group in Windows, the user will be prevented from authenticating using NTLM, and connections through StrongDM will no longer work.
Prerequisites
- Before you begin, ensure that the server you are attempting to add is accessible from your StrongDM gateways or relays. You must have a properly functioning gateway or relay up and running, and it must be able to reach the target server before you can proceed. To verify, go to the gateway or relay server and from a command prompt, type
ping <YOUR_HOSTNAME>. If your gateway or relay can connect to this hostname, you can continue. For more information see nodes. - The RDP server must be configured to require TLS encryption from connecting clients, rather than RDP native encryption.
Add an RDP Server
To add your RDP server as a StrongDM resource, use the following steps.
- Log in to the Admin UI and go to Resources > Servers.
- Click Add server.
- Select RDP as the Server Type and set other resource properties to configure how the StrongDM relay connects to the server.
- Click create to save the resource.
- Click the resource name to view status, diagnostic information, and setting details. After the server is created, the Admin UI displays that resource as unhealthy until the health checks run successfully. When the resource is ready, the Health icon indicates a positive, green status.
Resource properties
Configuration properties are visible when you add a Server Type or when you click to view the server’s settings.
The following table describes the settings available for your RDP server.
| Property | Requirement | Description |
|---|---|---|
| Display Name | Required | Meaningful name to display the resource throughout StrongDM; exclude special characters like quotes (") or angle brackets (< or >) |
| Server Type | Required | Select RDP |
| Hostname | Required | IP/DNS address used to connect to the resource from your gateway or relay (for example, windows-server.strongdm.com) |
| Port | Required | Port on the target server that is listening for RDP connections; default port value 3389 |
| Bind Interface | Read-only | Automatically generated IP address value in the 127.0.0.1 to 127.255.255.254 IP address range; default is 127.0.0.1; preferred bind interface value can be modified later under Settings > Port Overrides |
| Port Override | Optional | Automatically generated with a value between 1024-59999 as long as that port is not used by another resource; preferred port can be modified later under Settings > Port Overrides |
| Secret Store | Optional | Credential store location; defaults to Strong Vault. |
| Key Type | Required | Signing algorithm with default value set to RSA-2048; other options include RSA-4096, ECDSA-256, ECDSA-384, ECDSA-521, and ED25519. |
| Username | Required | Enter the username the relay should utilize to connect to the server via RDP (for example, mydomain\administrator) |
| Password | Required | Enter the password for the provided username |
| Resource Lock Required | Required | Enables a resource lock which can lock access the resource to ensure it can only be used by one user at a time; defaults to disabled |
| Resource Tags | Optional | Resource tags consisting of key-value pairs <KEY>=<VALUE> (for example, env=dev) |
After the RDP Server is created, the Admin UI updates and shows your new server in a green or yellow state. Green indicates a successful connection. If it is yellow, click the pencil icon to the right of the server to re-open the Connection Details screen. Then click Diagnostics to determine where the connection is failing.
Windows Network Level Authentication (NLA)
Windows NLA is a security protocol used by the Remote Desktop Service. When enabled, it completes additional client-side verifications. Moreover, StrongDM will automatically detect and use Windows NLA if it is enabled. However, some variations of NLA are not supported. For example, you may encounter error messages such as the following in your sdm.log file:
cannot extract server's sent public key: failed to handshake tls conn:
read tcp4 172.22.64.180:35118->172.22.20.44:3389: read: connection reset by peer"
cannot complete server NLA authentication: cannot parse ntlm echo packet:
cannot read class byte: remote error: tls: internal error
Users may also see similar errors when trying to connect to RDP servers.
Disable NLA for compatibility with older CLI versions
If users of your organization’s RDP resource(s) are using a StrongDM CLI version less than 46.60.0 you may need to disable NLA on the RDP server(s). This requires two minor configuration changes to the resource and to your StrongDM organization.
- On the Windows resource the setting Require devices to use NLA to connect needs to be disabled.
- The StrongDM Support team must then enable a setting for your organization manually.