5

Is there any way to configure a Windows 7 RDP to require a client certificate to login. So user need to use the certificate and password (just like SSH or client-side certificates in HTTP)

If there is, could you point me a step by step article?

Improve this question
2
  • are you looking to not have to use user names?
    – Jim B
    Jun 7, 2010 at 15:09
  • no usernames are fine, I want a stronger 2 factor authentication, that's it.
    – Ronald Maran
    Jun 14, 2010 at 16:49

1 Answer 1

Reset to default
1

You need to set up domain and server isolation in order to use certificates to encrypt traffic using IPSEC. All traffic is encypted by default at the highest level supported by the client (unless you have configured it not to fall back to older encryption methods) so if you are looking to just encrypt you don't need to change anything.

Improve this answer
4
  • Actually I'm not looking to encrypt I want to use certificate to authenticate.
    – Ronald Maran
    Jun 14, 2010 at 17:28
  • 1
    certificates would not be 2 factor authentication as the certificate would already be already installed (AKA IPSEC). Standard client side encryption is already enabled by default. With client side certs in SSH you are identifying the client not the user. In a windows domain we already have that authentication by default (that’s why Active Directory requires machine accounts for domain members), so in order to limit machies to ones you want to limit them to you need to use domain and server isolation. If you could add your own certs it would be weaker than the domain level security.
    – Jim B
    Jun 14, 2010 at 19:38
  • 2
    Gratulations, Jim - you pretty much ignored what he said and go on ranting how good AD is. He likely wants to use certificates instead of passwords, which coems in quite handy at times. It needs an AD integrated setup (certificates registered with the domain) but is fully supported bya windows. Sadly it requires hardware on the client, to my knowledge. Using a file certificate deos nto work.
    – TomTom
    Feb 27, 2012 at 14:54
  • I wouldn't say I ignored it. The OP wanted 2 factor auth using certs- he explicitly said that in the comments. My answer explains that installing certs on the system wouldn't help. I do agree that some sort of hardware authentication (which may or may not use certs) would fulfill the 2 factor auth request. Without additional hardware my answers helps by pointing out that you can reduce the attack surface by easily limiting machine interaction and gain the same level of authentication (since the machines are authorized) using network isolation.
    – Jim B
    Feb 27, 2012 at 20:56

You must log in to answer this question.