What is a Remote Desktop Gateway?
Opening port 3389 (RDP) directly on your corporate firewall to allow employees to remotely access their office PCs is extremely dangerous and a massive target for ransomware. A Remote Desktop Gateway (RD Gateway) solves this by acting as a secure proxy. It encapsulates standard RDP traffic inside an encrypted HTTPS (port 443) tunnel. External users securely authenticate with the Gateway server over HTTPS, and the Gateway server then establishes the internal RDP connection to the target PC on their behalf.
Step 1: Install the RD Gateway Role
Log in to your Windows Server. Open Server Manager and launch the Add roles and features wizard. Select Remote Desktop Services installation on the Installation Type screen. Follow the wizard, selecting Standard deployment, then Session-based desktop deployment. When prompted for Role Services, ensure you specify a server to host the RD Gateway role. (Note: In a single-server deployment, all RD roles can exist on one machine, though separating the Gateway into a DMZ is standard for larger networks).
Step 2: Install an SSL Certificate
Because the RD Gateway uses HTTPS, you must install a trusted SSL certificate. The certificate’s Subject Name must match the external DNS name your remote users will type (e.g., remote.yourcompany.com).
Open the RD Gateway Manager from the Server Manager Tools menu. Right-click your server name, select Properties, and go to the SSL Certificate tab. Import your purchased certificate and apply it.
Step 3: Create a Remote Desktop Connection Authorization Policy (RD CAP)
The RD CAP determines who is allowed to connect to the Gateway server. In the RD Gateway Manager, expand Policies, right-click Connection Authorization Policies, and select Create New Policy….
Use the wizard to create a custom policy. Provide a name (e.g., “Allow Domain Users”). On the Requirements tab, add the specific Active Directory User Group that should be granted remote access (e.g., “Domain Users” or a custom “Remote Access Users” group). Leave the other settings at default and click Finish.
Step 4: Create a Remote Desktop Resource Authorization Policy (RD RAP)
The RD RAP determines what internal computers the authenticated users are allowed to connect to. Right-click Resource Authorization Policies and select Create New Policy….
Name the policy (e.g., “Allow All Corporate PCs”). In the User Groups tab, add the same user group from Step 3. In the Network Resource tab, select the Active Directory Computer Group containing the PCs you want them to reach. For testing, you can select “Allow users to connect to any network resource,” but this should be tightened for production environments. Click Finish.
Step 5: Configure the Client Connection
Your RD Gateway is now operational. Ensure your firewall is forwarding TCP port 443 to the Gateway server.
To connect, open the standard Remote Desktop Connection (mstsc.exe) app on a remote Windows PC. Click Show Options, go to the Advanced tab, and click the Settings… button under “Connect from anywhere.”. Select “Use these RD Gateway server settings” and enter your public DNS name (remote.yourcompany.com).
Go back to the General tab, enter the internal name or IP of the office PC you want to control, and click Connect. You will be prompted to authenticate twice: once for the Gateway, and once for the target PC itself. You are now securely managing internal resources over HTTPS!