Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How can I limit (RDP) access to a Windows Server not only by username/password but also with a client certificate?

Imagine creating a certificate and copying this to all computers from which I want to be able to access the server from.

This would not be as limited as IP based rules but would add some flexibility on the other hand as not every computer/laptop is in a certain domain or fix ip range.

share|improve this question
Are you talking about inside your network or publishing to the internet? – Tim Brigham Jan 9 '12 at 16:23
this would be a public network. – Uwe Jan 10 '12 at 13:27

One way is by implementing a smart card solution. Probably not what you are looking for due to the cost and pain threshold, but many smart cards are actually just that (hardware-based certificates with strong private key protection), and the Remote Desktop integration is seamless.

share|improve this answer

You could set up IPSEC with certificates on the affected machines, possibly in conjunction with NAP and use the Windows Firewall to filter RDP traffic which is coming in unencrypted.

Here is a walkthrough for a scenario which is similar to your request but using preshared keys instead of certificates.

But keep in mind that "creating a certificate and copying this to all computers" is a bad idea all in itself - you obviously should create one certificate per client and set up your access rules accordingly. This ensures confidentiality of your connections along with the possibility to revoke certificates as they get lost / disclosed without breaking other machine's connections.

Edit: something that might look tempting is setting up a Remote Desktop Gateway (basically an HTTPS tunnel gateway for RDP) and require client certificate authentication upon SSL connection setup via the IIS properties (the Gateway is implemented as an ASP.NET application within IIS). This however seems to be unsupported by the Remote Desktop Client - there is no way to provide a client certificate for a proxied connection.

share|improve this answer
I tried going down the remote desktop gateway route. There are a couple questions here that show why it doesn't work as expected. – Tim Brigham Jan 10 '12 at 14:35

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.