Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am looking at implementing some sort of multi-factor authentication for a Remote Desktop Gateway at a small office (less than 20 users).

Where would be a good place to start for a quality, economically-feasible solution for a small office?


share|improve this question
I just want to clarify when you say Remote Desktop Gateway you are referring to the Windows Server 2008 R2 Remote Desktop Gateway, yes? – sdanelson Dec 19 '10 at 3:18
Yes, that is correct. – Josh Brower Dec 19 '10 at 3:34
Have you considered TS Web Access with client certificates? – sdanelson Dec 19 '10 at 4:17
@sdanelson, that sounds like a good answer.... – AviD Dec 19 '10 at 6:30
@sdanelson, TS Web Access is not an option, as I need clients to connect back to their personal workstation, not run programs off of a TS – Josh Brower Dec 19 '10 at 12:36
up vote 5 down vote accepted

We're running a TSG with client certificates configured to allow users to connect to their desktops. As long as you allow port 443 and properly configure the resource access policy, it works. There's a tutorial on technet on how to achieve this.

However, we're only using it for a small number of people, and we've not run into any of the licensing issues that I think sdnelson mentions. I would check this out before progressing any further.

share|improve this answer

I would use Terminal Services Web Access with client certificates. With the scale you are talking about I think it is going to be the least cost.

share|improve this answer

Look into the new features of Windows 2008 R2 SP1 beta. Introduces some really nice remote desktop abilities. Some of these may apply/help/assist to you when its released.

share|improve this answer

I believe TSG supports radius, so you can use any two-factor authentication server. Ours starts at $240, so the expense is not that great. You might have to run something else in front of RDP that supports radius and then run the MS radius plugin NPS on AD. Here's a (reg-free) white paper on how to add two-factor auth to your network RDP isn't mentioned, but it describes how to implement a number of services so you can get a good overview (or any service or 2FA server).

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.