How to enable MFA for Remote Desktop (RDP) connections

In this article:

• Objective
• Prerequisites
• Steps to follow
• Related topics and articles

Objective

This article provides the steps to implement multi-factor authentication (MFA) for Microsoft Remote Desktop Protocol (RDP) connections. Configuring MFA for RDP helps secure both local and remote access to Windows, macOS, and Linux machines, effectively reducing the risk of password-based attacks, such as brute-force attempts. By implementing RDP MFA, organizations can ensure that only authorized users gain access to critical endpoints.

Prerequisites

• Endpoint MFA license: Your ADSelfService Plus license must include the Endpoint MFA license. Visit the store to purchase Endpoint MFA.
• SSL must be enabled: SSL must be enabled in ADSelfService Plus for secure communication, which is crucial when configuring RDP MFA.
• ADSelfService Plus login agent: The Windows logon agent that comes bundled with ADSelfService Plus must be installed on the machines that are going to be secured via RDP MFA.
• Access URL must be set to HTTPS: Navigate to Admin > Product Settings > Connection > Connection Settings > Configure Access URL and set the Protocol option to HTTPS.

Steps to follow

Step 1: Configure required authenticators

1. Log in to the ADSelfService Plus admin portal.
2. Navigate to Configuration > Multi-factor Authentication > Authenticators Setup.
3. Click the Choose the Policy drop-down, and select the policy for which you wish to enable MFA for RDP. This policy will determine which users will have MFA for RDP logins enabled.
4. Configure any of the authenticators present according to organizational preference. ADSelfService Plus supports 20 authentication methods.

   

   Figure 1: Configuring authenticators for RDP MFA in ADSelfService Plus.

Step 2: Configure settings for MFA for RDP

1. Navigate to Configuration > Multi-factor Authentication > MFA for Endpoints.
2. In the MFA for Machine Login section, select the check box next to Enable _ factor authentication for machine login, and choose the number of authentication factors you'd like to implement for Windows RDP MFA.
3. Choose the authentication methods you would like to implement to secure your RDP connections.
4. Click Save Settings.

   

   Figure 2: Enabling RDP MFA in ADSelfService Plus

Related topics and articles

Multi-factor authentication for RDP logins

2FA for Windows logins