Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there any way to configure a Windows 7 RDP to require a client certificate to login. So user need to use the certificate and password (just like SSH or client-side certificates in HTTP)

If there is, could you point me a step by step article?

share|improve this question
are you looking to not have to use user names? – Jim B Jun 7 '10 at 15:09
no usernames are fine, I want a stronger 2 factor authentication, that's it. – Ronald Maran Jun 14 '10 at 16:49

You need to set up domain and server isolation in order to use certificates to encrypt traffic using IPSEC. All traffic is encypted by default at the highest level supported by the client (unless you have configured it not to fall back to older encryption methods) so if you are looking to just encrypt you don't need to change anything.

share|improve this answer
Actually I'm not looking to encrypt I want to use certificate to authenticate. – Ronald Maran Jun 14 '10 at 17:28
certificates would not be 2 factor authentication as the certificate would already be already installed (AKA IPSEC). Standard client side encryption is already enabled by default. With client side certs in SSH you are identifying the client not the user. In a windows domain we already have that authentication by default (that’s why Active Directory requires machine accounts for domain members), so in order to limit machies to ones you want to limit them to you need to use domain and server isolation. If you could add your own certs it would be weaker than the domain level security. – Jim B Jun 14 '10 at 19:38
Gratulations, Jim - you pretty much ignored what he said and go on ranting how good AD is. He likely wants to use certificates instead of passwords, which coems in quite handy at times. It needs an AD integrated setup (certificates registered with the domain) but is fully supported bya windows. Sadly it requires hardware on the client, to my knowledge. Using a file certificate deos nto work. – TomTom Feb 27 '12 at 14:54
I wouldn't say I ignored it. The OP wanted 2 factor auth using certs- he explicitly said that in the comments. My answer explains that installing certs on the system wouldn't help. I do agree that some sort of hardware authentication (which may or may not use certs) would fulfill the 2 factor auth request. Without additional hardware my answers helps by pointing out that you can reduce the attack surface by easily limiting machine interaction and gain the same level of authentication (since the machines are authorized) using network isolation. – Jim B Feb 27 '12 at 20:56

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.