Multi-factor authentication for RDP logins

The need to protect RDP-based access

Remote Desktop Protocol (RDP) has become a commonly utilized method for remotely accessing systems, making it a prime target for threat actors. Unprotected RDP access can expose organizations to various cyberthreats, such as brute-force attacks and ransomware. A compromised RDP session could lead to data theft and disruptions to business operations. Implementing multi-factor authentication (MFA) for RDP-based logins enhances security by adding an additional layer of verification, making it much more difficult for threat actors to gain unauthorized access and ensuring that only trusted users can connect to critical systems.

Secure your RDP-based access with ADSelfService Plus

ManageEngine ADSelfService Plus, an identity security solution, helps secure RDP-based access to your organization’s computer systems by using adaptive MFA. This includes implementing authentication methods such as biometric authentication and one-time passwords during RDP logins in addition to traditional passwords. ADSelfService Plus ensures that exposed credentials become useless for unauthorized RDP access, providing an extra layer of security. It supports MFA for RDP-based access in Microsoft Windows systems.

For the detailed configuration steps, refer to the MFA for RDP knowledge base article.

How does MFA for RDP logins work?

To configure MFA for RDP logins, the ADSelfService Plus login agent must be installed on the machines that are going to be secured via RDP MFA. The agent acts as the intermediary between the RDP machine and ADSelfService Plus to enable MFA during RDP logins. Once these requirements are fulfilled, the process shown below takes place:

1. The user initiates an RDP connection to the RDP machine.
2. The system checks the user's credentials (password) against the local security system.
3. After successful primary authentication, the system moves to secondary authentication (MFA), handled by the ADSelfService Plus login agent.
4. The ADSelfService Plus login agent sends the MFA request to the ADSelfService Plus server for verification.
5. If the user completes the required authentication levels successfully, they are logged in to the machine.

Supported authentication methods

ADSelfService Plus supports a wide range of authenticators. Those that can be configured for RDP are listed here:

1. Biometric authentication (fingerprint/facial recognition)
2. Push notification authentication
3. Duo Security
4. Microsoft Authenticator
5. Google Authenticator
6. YubiKey authentication
7. RSA SecurID
8. RADIUS
9. Time-based one-time passwords (TOTPs)
10. Custom TOTP authenticators
11. Zoho OneAuth TOTPs
12. QR-code-based authentication
13. Security questions and answers
14. SMS and email verification

Why should you choose ADSelfService Plus?

Employing ADSelfService Plus' MFA for RDP logins delivers the following benefits:

• Customizable, granular configuration: Enforce specific authentication methods and the number of authentication factors for users belonging to certain domains, groups, and organizational units.
• Real-time audit reports: View detailed reports on RDP login attempts with information like the time of the login, the authentication methods used, and the authentication success or failure status.
• Ensured user adoption: Automate user enrollment in MFA for RDP by importing the domain information of users through CSV files or by forcing enrollment using login scripts.
• Simplified authentication: Use authentication techniques like fingerprint, push notification, YubiKey, and QR-code-based authentication to help users complete the RDP MFA process with minimal effort.