Two Factor Authentication prior/for access to Remote Client Session Request

[xoAlto]

Hi There,

 

I am looking into having some kind of Two Factor Authentication on/before users can access a Remote Client Session on our Microsoft Terminal Server (2012 R2) Farm. I am hoping that regular AD credentials would be one of the factors, but am open for the second factor; either on the same Terminal Server box or on a system/server before connecting to the Terminal Server.

 

All ideas welcome, although the cheaper the better!

 

-- Thanks

Alan xo

[Liam]

Duo auth?

[AngryITGuy]

We are looking to do a similar thing with our RDS farm and we are looking at https://azure.microsoft.com/en-gb/services/multi-factor-authentication/

[ajg]

We have been using azure MFA with our in-house RDS servers for a couple of years now and can't really fault it. They use their AD credentials and get either a phone call or pop up via an app on their mobile phones to authenticate. Integrates nicely with the Microsoft Remote Desktop apps as well as via the web gateway via a browser.

 

Obviously comes at a cost (but reasonable in my opinion) which is here: https://azure.microsoft.com/en-gb/pricing/details/multi-factor-authentication/

 

As we have about 100 staff using it regularly we went for the per user option, plan to investigate the volume licence option soon to see if that works out cheaper.

[Simcfc73]

We have been using azure MFA with our in-house RDS servers for a couple of years now and can't really fault it. They use their AD credentials and get either a phone call or pop up via an app on their mobile phones to authenticate. Integrates nicely with the Microsoft Remote Desktop apps as well as via the web gateway via a browser.

 

Obviously comes at a cost (but reasonable in my opinion) which is here: https://azure.microsoft.com/en-gb/pricing/details/multi-factor-authentication/

 

As we have about 100 staff using it regularly we went for the per user option, plan to investigate the volume licence option soon to see if that works out cheaper.

 

Just looking at this ourselves now and asked my reseller for the costing for volume licensing. £1.044 per user per month x 120 staff... I suppose less than £2k a year for a added layer of security isn't too bad if I can protect all my servers on site.

 

PS. Set this up on my admin account.. its nice after eventually setting everything up. Got the app on my phone along with the sms verification.. going to try remote desktop when I get home

Edited May 3, 2017 by Simcfc73

[ajg]

Just to let you know we are currently renewing our EES agreement and I believe you get MFA bundled in with a Azure AD Premium licences so we are looking at buying these this year as I am told it gives unlimited authentications for the number of users you licence. That should save us about £1000 a year on our MFA bill hopefully but needs a bit of setting up to link the two together. Also be aware that the last time I checked (it was a long time ago!) having the two way SMS authentication charges the end user for the return text message so we stick with the phone call or app to keep users happy.

[Simcfc73]

Just got a reply from my MS supplier and you can get it for £1.20 per year per user which isn't bad. Better than the Azure pricing. Seems a no brainer.

 

WC2-00009 - MultifctrAuthntctnOpen ShrdSvrALNG Subs OLV F 1Mth Acdmc AP Fclty PerUsr - £1.20

[fiza]

Resurrecting an old thread here but I am looking at 2FA for our Remote Access users. Using the link in post #3 it seems it's not available in the UK as you cannot pick UK from the list. Anyone using Azure 2FA for RDS?