> For the complete documentation index, see [llms.txt](https://docs.1kosmos.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.1kosmos.com/authentication/windows-workstation-mfa/deployment-scenarios/rdp.md). # RDP *** ### RDP with Agent on the Remote Server When the 1Kosmos Credential Provider is installed on both the source machine and the destination server, fully passwordless RDP is supported from v2.0.7.0. The destination server enforces MFA using the user's assigned Adaptive Auth Journey, and passwordless methods (QR Code, Push Notification, FIDO) are available without requiring a password. ### Admin Setup **Prerequisites** | Requirement | Detail | | --------------------------- | ---------------------------------------------------------------------------------------------- | | Agent version | v2.0.7.0 or later on both source and destination machines | | Agent installed | Credential Provider installed on the destination server as well as the source workstation | | SmartCardCredentialProvider | Must be enabled on the destination server (see below) | | Journey configured | User's Adaptive Auth Journey must include at least one passwordless method (QR, Push, or FIDO) | **Enable SmartCardCredentialProvider on the Destination Server** 1. On the destination server, open the registry editor and navigate to: ``` HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers\{8FD7E19C-3BF7-489B-A72C-846AB3678C96} ``` 2. If the `Disabled` value exists and is set to `1`, change it to `0`. 3. If the `Disabled` value does not exist, no action is required, the provider is active by default. 4. Restart the server or the Credential Provider service for the change to take effect. {% hint style="info" %} This registry key must be configured on the **destination** server, not the source workstation. If it is disabled on the destination, the 1Kosmos tile will not appear in the RDP credential prompt. {% endhint %} **Configure the Authentication Journey** 1. In AdminX, navigate to **Applications > Windows MFA > Adaptive Auth Journeys**. 2. Ensure the journey assigned to the user includes a passwordless authentication method. 3. Confirm the journey is assigned to the user group that will be connecting via RDP. 4. Save and publish the journey. ### User Guide **Passwordless RDP Login** 1. On the source machine, open **Remote Desktop Connection** and enter the hostname or IP address of the destination server. 2. Click **Connect**. 3. At the RDP credential prompt, click **More options**. 4. Click **Login with 1Kosmos**. 5. The passwordless methods configured in your journey are presented (e.g., QR Code, Push Notification, Security Key). 6. Complete the MFA challenge. 7. The RDP session is established and you are logged in to the remote server. {% hint style="info" %} If both a password and a passwordless method are configured in the journey, both will be presented. For a fully passwordless experience, ensure the journey is configured with a passwordless-only method. {% endhint %} ### Troubleshooting | Issue | Likely Cause | Resolution | | ------------------------------------------------------- | ---------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------ | | 1Kosmos tile not appearing in RDP credential prompt | SmartCardCredentialProvider disabled on destination; agent not installed on destination | Verify the registry key on the destination server; confirm the Credential Provider is installed on the destination | | Passwordless methods not available | Journey does not include a passwordless method | Update the assigned journey to include QR, Push, or FIDO | | RDP session fails after MFA completion | Network issue between source and destination; RDP port blocked | Verify RDP connectivity (port 3389) between source and destination; check Windows Firewall rules on the destination server | | User prompted for password despite passwordless journey | NLA (Network Level Authentication) enforcing credentials before the 1Kosmos tile appears | Disable NLA on the destination server if fully passwordless RDP is required; note that disabling NLA has security implications, consult your security policy | ### RDP without Agent on the Remote Server When the destination server does not have the 1Kosmos Credential Provider installed, the destination enforces standard Windows NLA/password authentication for the RDP session. In this configuration, 1Kosmos MFA cannot be enforced at the point of RDP session establishment on the destination. The source workstation may still enforce MFA for local login and unlock events, but the RDP connection itself is governed by the destination's native Windows authentication. {% hint style="warning" %} This configuration does not provide end-to-end MFA enforcement for RDP sessions. Users authenticate with a password at the RDP prompt on the destination server. This is a common scenario during phased rollouts where the agent has not yet been deployed to all servers. Plan agent deployment on destination servers to close this gap. {% endhint %} ### Admin Setup No additional configuration is required in AdminX for this scenario. The destination server uses standard Windows authentication. If your organisation requires MFA enforcement for all RDP sessions including to servers without the agent, consider one of the following approaches: | Approach | Description | | ----------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------- | | Deploy agent to destination servers | Install the Credential Provider on the destination server to enable full MFA enforcement | | RDP Gateway with MFA | Route RDP sessions through an RD Gateway that enforces MFA at the gateway level before the session reaches the destination | | Network access control | Restrict RDP access to destination servers via firewall rules so that only source machines with the agent installed can initiate connections | {% hint style="info" %} See [Configuration Reference](#) for the `Disable1KosmosOnCredUI` registry key if you need to control whether 1Kosmos intercepts CredUI prompts on the source machine during RDP initiation. {% endhint %} ### User Guide **RDP Login (No Agent on Destination)** 1. On the source machine, open **Remote Desktop Connection** and enter the hostname or IP address of the destination server. 2. Click **Connect**. 3. At the RDP credential prompt, enter your Windows username and password. 4. The RDP session is established using standard Windows authentication. {% hint style="info" %} No 1Kosmos MFA step occurs at the destination in this configuration. MFA is only enforced on the source workstation for local login and unlock events. {% endhint %} ### Troubleshooting | Issue | Likely Cause | Resolution | | ------------------------------------------------------- | ---------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------- | | User expects 1Kosmos tile but sees only password prompt | Agent not installed on destination server | Install the Credential Provider on the destination server. | | RDP connection refused | Destination server not configured to accept RDP; firewall blocking port 3389 | Enable Remote Desktop on the destination server; verify firewall rules permit RDP traffic from the source | | Credential prompt loops without connecting | Incorrect username or password; account locked on destination | Verify credentials; check account status in Active Directory | --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.1kosmos.com/authentication/windows-workstation-mfa/deployment-scenarios/rdp.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.