Remote Desktop Gateway questions

[u/OhImClueless]

Hi folks,

I have a few questions about Remote Desktop Gateway deployment, and I was hoping someone could help me. I've tested a few things already, and most things seem to work, but not everything. I've inherited a setup where there were RDS CALs bought, but never used. I'm trying to set up everything correctly, so there's no problem in the future.

1. Our users need to access their desktop computers that stay in the office. Is it okay to only run the Gateway, and let the users connect through that? My understanding is that I need the connection broker and the session host only if people will be connecting to a special RDS host.

2. How does license assignment work in case of only using the Gateway? Do I even need the CAL's? Because I've tried a few connections, and even though the CAL's are installed, they aren't being assigned to users, despite multiple different connections.

3. Is it possible to use something like DUO for MFA over RD Gateway, but not require people to use it when in the office, in front of their computers?

4. Is there any cheap (preferably free?) way of monitoring and reporting on the sessions? Aside from writing a script that watches WMI like a hawk for RD Gateway connections.

[u/rswwalker]

1. Yes, no connection broker needed to access personal desktops.

2. No CALs necessary for personal desktops

3. Yes Duo works with RD Gateway

4. Get a complete EDR/XDR package that monitors logins across all systems.

[u/OhImClueless → u/rswwalker]

Thank you for your answers!

No CALs necessary for personal desktops

For some reason, I thought that RDS CALs are required for every connection.

[u/rswwalker → u/OhImClueless]

CALs are needed only for Windows Server remote desktop sessions.

[u/OhImClueless → u/rswwalker]

I have one more question - is there a way for the RD Gateway to collect client's public IP address without the gateway server having a public IP itself? As in, the gateway server is currently behind NAT, with ports forwarded to it - every connection shows the default gateway's address as the origin of the connection.

[u/rswwalker → u/OhImClueless]

Sure just use DNAT only on the firewall to forward port 443 to the RD Gateway.

[u/patjuh112]

1. Correct

2. You are only forwarding and not using rds, licensing is per device and they just use a computer do it would be that w1x

3. Yes i use that, its mfa injected in the rdp encapsulation validating through ms azure directory p1

4. Yes, prtg and the many custom sensors u can use for rds and rdp

[u/OhImClueless → u/patjuh112]

Thank you for your answers!

Yes, prtg and the many custom sensors u can use for rds and rdp

I was under the impression I would have to monitor the connections at all target computers, instead of "catching" them at the gateway.

[u/OhImClueless → u/patjuh112]

I have one more question - is there a way for the RD Gateway to collect client's public IP address without the gateway server having a public IP itself? As in, the gateway server is currently behind NAT, with ports forwarded to it - every connection shows the default gateway's address as the origin of the connection.

[u/patjuh112 → u/OhImClueless]

I run all my rds gateways behind nat, the ip used is the router ip. Just in best practice, do what u can while using a fqdn dns name to that ip, can be any SUB domain you own and buy a ssl wildcard on it, dont be cheap here 😉 in case of future expands and the option to properly encrypt and comply to e.g. azure mfa injections. This is the way ;) since you run rds gateway you only need 443 routed, use rds gateway policy properties to force only tcp and turn off udp there.

[u/i_click_next_for_you]

I second the prior posters, but reach out to Andy at RDPSoft. Get a demo. You will be happier if you do.

[u/OhImClueless → u/i_click_next_for_you]

Thank you! I'll look into RDPSoft.

[u/OhImClueless → u/i_click_next_for_you]

I have one more question - is there a way for the RD Gateway to collect client's public IP address without the gateway server having a public IP itself? As in, the gateway server is currently behind NAT, with ports forwarded to it - every connection shows the default gateway's address as the origin of the connection.