Remote Desktop and Application Proxy - Has anyone managed to achieve this?

[CyBeRkId2002]

Hi all,

 

Basic gist of this is that I am looking for ways to improve our security around Remote Desktop and was hoping to leverage Microsoft MFA to do this. I have been on this an almost embarrassing amount of time today and seem to be getting nowhere!

 

I have tried to follow the Microsoft guide but as soon as I add the Application Proxy URL as the gateway address it stops working.

 

I did find one guide which involved creating two Application Proxies - a general one with passthrough auth enabled, and one specifically for RDWeb traffic which had Azure AD Auth turned on. Whilst this protects the RDWeb service, the core RD service seems just as vulnerable to attack as having your own hosted RD Gateway.

 

So, basically:

 

• Has anyone set this up
  
• With this system is it possible to publish a .rdp file that requires MFA? I suspect not and it doesn't use modern auth???
  
• Is it, therefore, a requirement to run in the browser using the /webclient URL (which is what I suspect) and have some kind of credential passthrough magic happening. This is what I suspect is the case - and the bit I can't get working!
  
• 
  

[chris11256]

As far as I understand it Azure Application Proxy is only compatible with the web client rather than the desktop client.

 

You can still get remote desktop to use MFA without the application proxy, Microsoft have a guide here on how to configure it. https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-nps-extension-rdg

[CyBeRkId2002]

Thanks for the info! I spent a whole day on this yesterday and came to the same conclusion. What I can't understand is how much safer this makes you from an attack service point of view. RDWeb is still underpinned by RDS, so if you do not have MFA at that point then in my opinion you are still a target for similar kinds of attacks.

 

I have put in place the solution you forwarded and tested as a proof of concept and seems to work fine! I would love a pop-up saying that it is awaiting a secondary verification (or even better a pop-up that also supports SMS codes!) as if staff are unaware then it is not very clear why it hangs on securing connection (or whatever the wording is). This is just a staff training issue and now I just need to get the nod from our leadership to implement.