Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a 2008 DC and a 2008 AD CS server and a Windows 7 client. What I would like is to require the certificate to be used when RDPing to the server.

The certificate is valid, and if I connect using the FQDN I am shown that i was authenticated by both the certificate and Kerberos as expected. When I connect with just the hostname I am allowed to connect and am only authenticated by Kerberos, even though I have Require TLS 1.0 set on the server that I am RDPing to. I fully understand that the certificate will not be valid unless the server is accessed by FQDN, what I want to do is disallow connections that do not use the certificate AND Kerberos.

I thought that setting Require TLS 1.0 would do it. What am I missing?

share|improve this question

3 Answers 3

up vote 8 down vote accepted
+100
  1. Start -> Administrative Tools -> Terminal Services -> Terminal Services Configuration
  2. Right click RDP-Tcp and choose Properties
  3. "Security Layer" defaults to "Negotiate" and must be changed to "SSL (TLS 1.0)"
  4. "Encryption Level" must be set to "High" or "FIPS Compliant"

Reference: http://technet.microsoft.com/en-us/library/cc782610(WS.10).aspx

edit: The Microsoft Technet article indicates that TLS cannot be enabled via Group Policy. However, I have done some experimentation with Process Monitor and Regedit and have determined that you can change these settings by setting the appropriate registry values, as follows.

To set Minimum Encryption Level to "High" instead of "Client Compatible":

HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp\MinEncryptionLevel REG_DWORD Value: 3

To set Security Layer to "SSL (TLS 1.0)" instead of "Negotiate":

HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp\SecurityLayer
REG_DWORD Value: 2

share|improve this answer
    
Hmm, no GPO support? Do you happen to know if this feature is exposed via WMI, so that it can be scripted in powershell? –  MDMarra Apr 2 '10 at 23:24
    
Mark: I don't know offhand, but I'll let you know if I come up with a supported or unsupported method. –  Skyhawk Apr 3 '10 at 18:21
    
Mark: Added registry key info for scripting. –  Skyhawk Apr 5 '10 at 14:12
    
@Mark: Has this worked well for you? Just let me know if there's anything else you need. –  Skyhawk Apr 8 '10 at 1:21
    
Haven't had a chance to test yet –  MDMarra Apr 8 '10 at 1:44

Have you confirmed with a packet capture that the client is not negotiating a TLS connection? That is the only way I know to definitively verify it is working as expected.

share|improve this answer

To test your scenario, here is what I did:

  • I have Windows Server 2008 R2 DC
  • Installed Roles -> Active Directory Certificate Services, Active Directory Domain Services, Remote Desktop Services -> Remote Desktop Web Access, Web Server (IIS). Since this is my only DC, I have DNS Server and DHCP Server installed as well
  • Installed Server Authentication Certificate on my IIS Web site, it also hosts RDWeb application
  • Change Authentication on RDWeb from Anonymous to Windows Authentication
  • accessed the Web site from the server itself, URL: https://localhost/rdweb. Works fine
  • From my client (which is Windows Server 2008 R2), tried accessing URL: https://fqdn/rdweb works. Also, tried URL: https://server_name/rdweb.. works.

NOTE: we are still not sure if it's using TLS 1.0

Now, to force RDWeb to work on TLS only:

  1. Open Regedit
  2. Go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
  3. Create a new Binary Value and name it SSLCertificateSHA1Hash
  4. Copy the thumbprint from the SSL Certificate and add it as the value of SSLCertificateSHA1Hash

e.g.:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp]
"SSLCertificateSHA1Hash"="hex:‎23,91,fc,0e,95,ad,e9,3e,fa,df,3d,54,54,f0,99,dc,cd,70,5c,5c"

Now, accessed the website URL: https://fqdn/rdweb while tracing it using fiddler, we see all HTTPS connection with Cipher: 0x2F. Tried using the URL: https://server_name the same result.

According to http://tools.ietf.org/html/rfc5289,
CipherSuite TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 = {0xC0,0x2F};

Also, check this RDP with custom certificate in Windows 7? (No tsconfig.msc or Group Policy setting)

For WMI, you can check the article Win32_TSGeneralSetting Class

share|improve this answer
    
I'm not using remote desktop web access. Just regular RDP with TLS. –  MDMarra Apr 8 '10 at 4:33
    
@MarkM: I hope you have already checked blogs.technet.com/askperf/archive/2008/10/31/… –  Vivek Kumbhar Apr 8 '10 at 6:26

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.