Skip to content

Commit 7c5f9d0

Browse files
v-dirichardsv-dirichards
authored
Merge pull request #267706 from dknappettmsft/avd-unidirectional-clipboard-policy-preview
AVD unidirectional clipboard policy preview
2 parents e43f371 + ac1fa43 commit 7c5f9d0

File tree

3 files changed

+191
-1
lines changed

3 files changed

+191
-1
lines changed

‎articles/virtual-desktop/TOC.yml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -454,6 +454,9 @@
454454
- name: Watermarking
455455
displayName: security
456456
href: watermarking.md
457+
- name: Configure clipboard transfer direction
458+
displayName: security
459+
href: clipboard-transfer-direction-data-types.md
457460
- name: Set up a disaster recovery plan
458461
displayName: bcdr, bc dr
459462
href: disaster-recovery.md

‎articles/virtual-desktop/administrative-template.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ ms.date: 08/25/2023
77
ms.author: daknappe
88
---
99

10-
# Administrative template for Azure Virtual Desktop
10+
# Use the administrative template for Azure Virtual Desktop
1111

1212
We've created an administrative template for Azure Virtual Desktop to configure some features of Azure Virtual Desktop. You can use the template with:
1313

‎articles/virtual-desktop/clipboard-transfer-direction-data-types.md

Lines changed: 187 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,187 @@
1+
---
2+
title: Configure the clipboard transfer direction in Azure Virtual Desktop
3+
description: Learn how to configure the clipboard in Azure Virtual Desktop to function only in a single direction (unidirectional), from session host to client, or client to session host.
4+
ms.topic: how-to
5+
author: dknappettmsft
6+
ms.author: daknappe
7+
ms.date: 02/29/2024
8+
---
9+
10+
# Configure the clipboard transfer direction and types of data that can be copied in Azure Virtual Desktop
11+
12+
> [!IMPORTANT]
13+
> Configuring the clipboard transfer direction in Azure Virtual Desktop is currently in PREVIEW.
14+
> See the [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) for legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability.
15+
16+
Clipboard redirection in Azure Virtual Desktop allows users to copy and paste content, such as text, images, and files between the user's device and the remote session in either direction. You might want to limit the direction of the clipboard for users, to help prevent data exfiltration or malicious files being copied to a session host. You can configure whether users can use the clipboard from session host to client, or client to session host, and the types of data that can be copied, from the following options:
17+
18+
- Disable clipboard transfers from session host to client, client to session host, or both.
19+
- Allow plain text only.
20+
- Allow plain text and images only.
21+
- Allow plain text, images, and Rich Text Format only.
22+
- Allow plain text, images, Rich Text Format, and HTML only.
23+
24+
You apply settings to your session hosts. It doesn't depend on a specific Remote Desktop client or its version. This article shows you how to configure the direction the clipboard and the types of data that can be copied using Microsoft Intune, or you can configure the local Group Policy or registry of session hosts.
25+
26+
## Prerequisites
27+
28+
To configure the clipboard transfer direction, you need:
29+
30+
- Session hosts running Windows 11 Insider Preview Build 25898 or later.
31+
32+
- Depending on the method you use to configure the clipboard transfer direction:
33+
34+
- For Intune, you need permission to configure and apply settings. For more information, see [Administrative template for Azure Virtual Desktop](administrative-template.md).
35+
36+
- For configuring the local Group Policy or registry of session hosts, you need an account that is a member of the local Administrators group.
37+
38+
## Configure clipboard transfer direction
39+
40+
Here's how to configure the clipboard transfer direction and the types of data that can be copied. Select the relevant tab for your scenario.
41+
42+
# [Intune](#tab/intune)
43+
44+
To configure the clipboard using Intune, follow these steps. This process [deploys an OMA-URI to target a CSP](/troubleshoot/mem/intune/device-configuration/deploy-oma-uris-to-target-csp-via-intune).
45+
46+
1. Sign in to the [Microsoft Intune admin center](https://endpoint.microsoft.com/).
47+
48+
1. [Create a profile with custom settings](/mem/intune/configuration/custom-settings-configure) for Windows 10 and later devices, with the **Templates** profile type and the **Custom** profile template name.
49+
50+
1. For the **Basics** tab, enter a name and optional description for the profile, and then select **Next**.
51+
52+
1. For the **Configuration settings** tab, select **Add** to show the **Add row** pane.
53+
54+
1. In the **Add row** pane, enter one of the following sets of settings, depending on whether you want to configure the clipboard from session host to client, or client to session host.
55+
56+
- To configure the clipboard from **session host to client**:
57+
- **Name**: (*example*) Session host to client
58+
- **Description**: *Optional*
59+
- **OMA-URI**: `./Vendor/MSFT/Policy/Config/RemoteDesktopServices/LimitServerToClientClipboardRedirection`
60+
- **Data type**: `String`
61+
- **Value**: Enter a value from the following table:
62+
63+
| Value | Description |
64+
|--|--|
65+
| `<![CDATA[<enabled/><data id="TS_SC_CLIPBOARD_RESTRICTION_Text" value="0"/>]]>` | Disable clipboard transfers from session host to client. |
66+
| `<![CDATA[<enabled/><data id="TS_SC_CLIPBOARD_RESTRICTION_Text" value="1"/>]]>` | Allow plain text. |
67+
| `<![CDATA[<enabled/><data id="TS_SC_CLIPBOARD_RESTRICTION_Text" value="2"/>]]>` | Allow plain text and images. |
68+
| `<![CDATA[<enabled/><data id="TS_SC_CLIPBOARD_RESTRICTION_Text" value="3"/>]]>` | Allow plain text, images, and Rich Text Format. |
69+
| `<![CDATA[<enabled/><data id="TS_SC_CLIPBOARD_RESTRICTION_Text" value="4"/>]]>` | Allow plain text, images, Rich Text Format, and HTML. |
70+
71+
- To configure the clipboard from **client to session host**:
72+
- **Name**: (*example*) Client to session host
73+
- **Description**: *Optional*
74+
- **OMA-URI**: `./Vendor/MSFT/Policy/Config/RemoteDesktopServices/LimitClientToServerClipboardRedirection`
75+
- **Data type**: `String`
76+
- **Value**: Enter a value from the following table:
77+
78+
| Value | Description |
79+
|--|--|
80+
| `<![CDATA[<enabled/><data id="TS_CS_CLIPBOARD_RESTRICTION" value="0"/>]]>` | Disable clipboard transfers from session host to client. |
81+
| `<![CDATA[<enabled/><data id="TS_CS_CLIPBOARD_RESTRICTION" value="1"/>]]>` | Allow plain text. |
82+
| `<![CDATA[<enabled/><data id="TS_CS_CLIPBOARD_RESTRICTION" value="2"/>]]>` | Allow plain text and images. |
83+
| `<![CDATA[<enabled/><data id="TS_CS_CLIPBOARD_RESTRICTION" value="3"/>]]>` | Allow plain text, images, and Rich Text Format. |
84+
| `<![CDATA[<enabled/><data id="TS_CS_CLIPBOARD_RESTRICTION" value="4"/>]]>` | Allow plain text, images, Rich Text Format, and HTML. |
85+
86+
1. Select **Save** to add the row. Repeat the previous two steps to configure the clipboard in the other direction, if necessary, then once you configure the settings you want, select **Next**.
87+
88+
1. For the **Assignments** tab, select the users, devices, or groups to receive the profile, then select **Next**. For more information on assigning profiles, see [Assign user and device profiles](/mem/intune/configuration/device-profile-assign).
89+
90+
1. For the **Applicability Rules** tab, select **Next**.
91+
92+
1. On the **Review + create** tab, review the configuration information, then select **Create**.
93+
94+
1. Once the policy configuration is created, resync your session hosts and reboot them for the settings to take effect.
95+
96+
1. Connect to a remote session with a supported client and test the clipboard settings you configured are working by trying to copy and paste content.
97+
98+
# [Group Policy](#tab/group-policy)
99+
100+
To configure the clipboard using Group Policy, follow these steps.
101+
102+
> [!IMPORTANT]
103+
> These policy settings appear in both **Computer Configuration** and **User Configuration**. If both policy settings are configured, the stricter restriction is used.
104+
105+
1. Open **Local Group Policy Editor** from the Start menu or by running `gpedit.msc`.
106+
107+
1. Browse to one of the following policy sections. Use the policy section in **Computer Configuration** to the session host you target, and use the policy section in **User Configuration** applies to specific users you target.
108+
109+
- Machine: `Computer Configuration\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Device and Resource Redirection`
110+
- User: `User Configuration\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Device and Resource Redirection`
111+
112+
1. Open one of the following policy settings, depending on whether you want to configure the clipboard from session host (server) to client, or client to session host:
113+
114+
- To configure the clipboard from **session host to client**, open the policy setting **Restrict clipboard transfer from server to client**, then select **Enabled**. Choose from the following options:
115+
- **Disable clipboard transfers from server to client**.
116+
- **Allow plain text.**
117+
- **Allow plain text and images.**
118+
- **Allow plain text, images, and Rich Text Format.**
119+
- **Allow plain text, images, Rich Text Format, and HTML.**
120+
121+
- To configure the clipboard from **client to session host**, open the policy setting **Restrict clipboard transfer from client to server**, then select **Enabled** . Choose from the following options:
122+
- **Disable clipboard transfers from client to server**.
123+
- **Allow plain text.**
124+
- **Allow plain text and images.**
125+
- **Allow plain text, images, and Rich Text Format.**
126+
- **Allow plain text, images, Rich Text Format, and HTML.**
127+
128+
1. Select **OK** to save your changes.
129+
130+
1. Once you configured settings, restart your session hosts for the settings to take effect.
131+
132+
1. Connect to a remote session with a supported client and test the clipboard settings you configured are working by trying to copy and paste content.
133+
134+
> [!TIP]
135+
> During the preview, you can also configure Group Policy centrally in an Active Directory domain by copying the `terminalserver.admx` and `terminalserver.adml` administrative template files from a session host to the [Group Policy Central Store](/troubleshoot/windows-client/group-policy/create-and-manage-central-store) in a test environment.
136+
137+
# [Registry](#tab/registry)
138+
139+
To configure the clipboard using the registry on a session host, follow these steps.
140+
141+
1. Open **Registry Editor** from the Start menu or by running `regedit.exe`.
142+
143+
1. Set one of the following registry keys and its value, depending on whether you want to configure the clipboard from session host to client, or client to session host.
144+
145+
- To configure the clipboard from **session host to client**, set one of the following registry keys and its value. Using the value for the machine applies to all users, and using the value for the user applies to the current user only.
146+
- **Key**:
147+
- Machine: `HKLM\Software\Policies\Microsoft\Windows NT\Terminal Services`
148+
- Users: `HKCU\Software\Policies\Microsoft\Windows NT\Terminal Services`
149+
- **Type**: `REG_DWORD`
150+
- **Value name**: `SCClipLevel`
151+
- **Value data**: Enter a value from the following table:
152+
153+
| Value Data | Description |
154+
|--|--|
155+
| `0` | Disable clipboard transfers from session host to client. |
156+
| `1` | Allow plain text. |
157+
| `2` | Allow plain text and images. |
158+
| `3` | Allow plain text, images, and Rich Text Format. |
159+
| `4` | Allow plain text, images, Rich Text Format, and HTML. |
160+
161+
- To configure the clipboard from **client to session host**, set one of the following registry keys and its value. Using the value for the machine applies to all users, and using the value for the user applies to the current user only.
162+
- **Key**:
163+
- Machine: `HKLM\Software\Policies\Microsoft\Windows NT\Terminal Services`
164+
- Users: `HKCU\Software\Policies\Microsoft\Windows NT\Terminal Services`
165+
- **Type**: `REG_DWORD`
166+
- **Value name**: `CSClipLevel`
167+
- **Value data**: Enter a value from the following table:
168+
169+
| Value Data | Description |
170+
|--|--|
171+
| `0` | Disable clipboard transfers from client to session host. |
172+
| `1` | Allow plain text. |
173+
| `2` | Allow plain text and images. |
174+
| `3` | Allow plain text, images, and Rich Text Format. |
175+
| `4` | Allow plain text, images, Rich Text Format, and HTML. |
176+
177+
1. Restart your session host.
178+
179+
1. Connect to a remote session with a supported client and test the clipboard settings you configured are working by trying to copy and paste content.
180+
181+
---
182+
183+
## Related content
184+
185+
- Configure [Watermarking](watermarking.md).
186+
- Configure [Screen Capture Protection](screen-capture-protection.md).
187+
- Learn about how to secure your Azure Virtual Desktop deployment at [Security best practices](security-guide.md).

0 commit comments

Comments
 (0)