RDP

1Kosmos Credential Provider supports MFA enforcement for both incoming and outgoing Remote Desktop Protocol (RDP) sessions.

---

RDP with Agent on the Remote Server

When the 1Kosmos Credential Provider is installed on both the source machine and the destination server, fully passwordless RDP is supported from v2.0.7.0. The destination server enforces MFA using the user's assigned Adaptive Auth Journey, and passwordless methods (QR Code, Push Notification, FIDO) are available without requiring a password.

Admin Setup

Prerequisites

Requirement	Detail
Agent version	v2.0.7.0 or later on both source and destination machines
Agent installed	Credential Provider installed on the destination server as well as the source workstation
SmartCardCredentialProvider	Must be enabled on the destination server (see below)
Journey configured	User's Adaptive Auth Journey must include at least one passwordless method (QR, Push, or FIDO)

Enable SmartCardCredentialProvider on the Destination Server

1. On the destination server, open the registry editor and navigate to:

   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers\{8FD7E19C-3BF7-489B-A72C-846AB3678C96}

2. If the Disabled value exists and is set to 1, change it to 0.

3. If the Disabled value does not exist, no action is required, the provider is active by default.

4. Restart the server or the Credential Provider service for the change to take effect.

This registry key must be configured on the destination server, not the source workstation. If it is disabled on the destination, the 1Kosmos tile will not appear in the RDP credential prompt.

Configure the Authentication Journey

1. In AdminX, navigate to Applications > Windows MFA > Adaptive Auth Journeys.

2. Ensure the journey assigned to the user includes a passwordless authentication method.

3. Confirm the journey is assigned to the user group that will be connecting via RDP.

4. Save and publish the journey.

User Guide

Passwordless RDP Login

1. On the source machine, open Remote Desktop Connection and enter the hostname or IP address of the destination server.

2. Click Connect.

3. At the RDP credential prompt, click More options.

4. Click Login with 1Kosmos.

5. The passwordless methods configured in your journey are presented (e.g., QR Code, Push Notification, Security Key).

6. Complete the MFA challenge.

7. The RDP session is established and you are logged in to the remote server.

If both a password and a passwordless method are configured in the journey, both will be presented. For a fully passwordless experience, ensure the journey is configured with a passwordless-only method.

Troubleshooting

Issue	Likely Cause	Resolution
1Kosmos tile not appearing in RDP credential prompt	SmartCardCredentialProvider disabled on destination; agent not installed on destination	Verify the registry key on the destination server; confirm the Credential Provider is installed on the destination
Passwordless methods not available	Journey does not include a passwordless method	Update the assigned journey to include QR, Push, or FIDO
RDP session fails after MFA completion	Network issue between source and destination; RDP port blocked	Verify RDP connectivity (port 3389) between source and destination; check Windows Firewall rules on the destination server
User prompted for password despite passwordless journey	NLA (Network Level Authentication) enforcing credentials before the 1Kosmos tile appears	Disable NLA on the destination server if fully passwordless RDP is required; note that disabling NLA has security implications, consult your security policy

RDP without Agent on the Remote Server

When the destination server does not have the 1Kosmos Credential Provider installed, the destination enforces standard Windows NLA/password authentication for the RDP session. In this configuration, 1Kosmos MFA cannot be enforced at the point of RDP session establishment on the destination. The source workstation may still enforce MFA for local login and unlock events, but the RDP connection itself is governed by the destination's native Windows authentication.

This configuration does not provide end-to-end MFA enforcement for RDP sessions. Users authenticate with a password at the RDP prompt on the destination server. This is a common scenario during phased rollouts where the agent has not yet been deployed to all servers. Plan agent deployment on destination servers to close this gap.

Admin Setup

No additional configuration is required in AdminX for this scenario. The destination server uses standard Windows authentication.

If your organisation requires MFA enforcement for all RDP sessions including to servers without the agent, consider one of the following approaches:

Approach	Description
Deploy agent to destination servers	Install the Credential Provider on the destination server to enable full MFA enforcement
RDP Gateway with MFA	Route RDP sessions through an RD Gateway that enforces MFA at the gateway level before the session reaches the destination
Network access control	Restrict RDP access to destination servers via firewall rules so that only source machines with the agent installed can initiate connections

See Configuration Reference for the Disable1KosmosOnCredUI registry key if you need to control whether 1Kosmos intercepts CredUI prompts on the source machine during RDP initiation.

User Guide

RDP Login (No Agent on Destination)

1. On the source machine, open Remote Desktop Connection and enter the hostname or IP address of the destination server.

2. Click Connect.

3. At the RDP credential prompt, enter your Windows username and password.

4. The RDP session is established using standard Windows authentication.

No 1Kosmos MFA step occurs at the destination in this configuration. MFA is only enforced on the source workstation for local login and unlock events.

Troubleshooting

Issue	Likely Cause	Resolution
User expects 1Kosmos tile but sees only password prompt	Agent not installed on destination server	Install the Credential Provider on the destination server.
RDP connection refused	Destination server not configured to accept RDP; firewall blocking port 3389	Enable Remote Desktop on the destination server; verify firewall rules permit RDP traffic from the source
Credential prompt loops without connecting	Incorrect username or password; account locked on destination	Verify credentials; check account status in Active Directory