• Cloud Edge Secure Access
• Welcome to SonicWall Cloud Edge!
• Prerequisites
• Installation
  • Accessing the Client Management Console
  • Installation Methods
• Networks
  • Understanding Networks
  • SDP Networks
  • Regions and Gateways
    • Adding a region
    • Adding a gateway
  • Connecting Infrastructure
    • Prerequisites
    • Site-to-Site Connections
    • IPsec Tunnel
    • WireGuard Connector
    • Connect On-Prem Resources
      • Firewalls
        • SonicWall
    • Connect Cloud Resources
      • Amazon AWS
        • AWS Virtual Gateway
        • AWS Transit Gateway
      • Alibaba Cloud
      • Microsoft Azure
      • Google Cloud Platform
      • Heroku Enterprise
      • IBM Cloud
      • Docker
• Groups and Members
  • Members
    • Inviting Members
    • Password Requirements
    • Managing Roles
  • Groups
    • Managing Groups
    • Identity Provider Groups
  • Identity Providers (IdP)
    • Integrate Identity Providers
    • Azure AD
      • Azure Active Directory (SAML 2.0)
      • Azure Active Directory
    • Google Suite
      • Google Services
      • Google Apps (SAML 2.0)
    • On-Premises Active Directory
    • SAML 2.0
      • Generic SAML
      • Active Directory Federation Services (ADFS)
      • Auth0
      • Okta
      • OneLogin
      • PingIdentity
      • JumpCloud
• Securing the Platform
  • Securing Networks
    • Segmenting Networks
    • Device Posture Check
    • Network Traffic Control
    • Firewall-as-a-Service
  • Securing User Access
    • Multi-Factor Authentication
      • MFA Authentication
      • DUO Security
    • Agent-less Access
      • Zero Trust Application
        • HTTP/HTTPS
        • RDP (Remote Desktop Protocol)
        • SSH (Secure Shell)
        • VNC (Virtual Network Computing)
      • Zero Trust Policies and Rules
    • Agent-based Access
      • SonicWall Agents
        • Downloading and Installation
      • Agents Configuration
        • User-Groups Policies
        • Managing Configurations
        • General Configurations
        • Network Configuration
        • OS-Specific Configurations
• Monitoring
  • Activity Tracking
    • Activities and Logs
    • Member Devices
  • Monitoring Dashboard
  • Integrations
    • Amazon S3
    • Azure Sentinel
    • Splunk Cloud
• Compliance
  • HIPAA
  • GDPR
  • SOC 2 Type 2
• SonicWall Support
  • About This Document

RDP (Remote Desktop Protocol)

Adding an RDP Zero Trust application

This article describes how to configure a Zero Trust RDP Application to a remote Windows instance, such as Windows Server 2016 / Windows 10.

Before we begin

Make sure you are familiar with the server's authentication methods (username and password or RDP keys) and that you have a tunnel connecting your network and the environment that hosts the Windows instance.

1. Go to the Applications tab at the SonicWall Cloud Edge Platform. Select Add application.

   

2. Fill in the following information:

   

   • Application Name: Choose an indicative name of your own choice.
   • Protocol: RDP
   • Icon: Use default or choose an icon of your own choice.
   • Host: Enter the internal IP address of the server to which you'd like to connect.
   • Port: 3389
   • Network: Choose the network that contains the gateway from which you created a tunnel to the environment that hosts the server you'd like to connect to.
   • Max number of connections: The maximum number of concurrent RDP sessions.
   • Ignore server certificate: Yes, unless you activate an RDP over SSL.
   • Admin console: Connect directly to the console session on the Windows server.
   • Display Application Icon at Login Screen: Choose according to your preference.

   • Enable copy-paste from RDP to clipboard: Default: yes

   • Enable printing from RDP: Default: yes

   • URL Alias (Optional): See Advanced Setting Guide.

   • Security Mode: This mode dictates how data will be encrypted and what type of authentication will be performed if any. By default, a security mode is selected based on a negotiation process that determines what both the client and the server support.

     

   • Authentication:

     Username and Password: Enter one set of credentials as predefined on the server. You will not be required to enter any parameter with the login.

     Domain: If applicable, enter your active directory FQDN.

     If the Authentication toggle is Disabled, you'll need to enter your credentials as predefined on the Windows instance with every new RDP login.

     Windows Server 2016 and Windows 10 instances will need an additional configuration.

     Please follow the "Windows Server 2016 / Windows 10" section below.

   • Access Groups: State the names of the user groups that will have access to the RDP application.

   • Policy: Leave blank, or choose a policy that was previously created and matches your needs.

     

Configuration and troubleshooting

Windows 7 users:

Registry modifications may be required in case you're operating on a Windows 7 device.

• Navigate to HKEY_LOCAL_MACHINE -> Software -> Microsoft -> Windows NT -> Terminal Services.

• Select "fServerEnableRDP8".

  • Set the value type to "REG_DWORD".

  • Make sure that the enabled value is 1 (disables value is 0).

• Reboot the machine.

Windows Server 2019 users:

Registry modifications may be required in case you're operating on a Windows 2019 server.

• Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp

• Select "SecurityLayer" and change the value to 0.

• Reboot the machine.

Upstream error:

1. If password authentication is enabled, and any security mode is selected, then the upstream error implies a wrong password or username. Please make sure your credentials are correct.

2. If password authentication is disabled, simply edit the application and choose TLS as your security mode.

   

Additional Troubleshooting steps

Disable NLA on the local machine:

1. Open Control Panel. Ensure that the control panel is showing items by Category (i.e., not in Classic View ).
2. Click on System and Security.

3. Under System click on Allow remote access.

   

4. Under the Remote group, un-tick the checkbox "Allow connections only from computers running Remote Desktop with Network Level Authentication (recommended)".

   

5. Click OK.