You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/virtual-desktop/configure-rdp-shortpath.md
+36-31Lines changed: 36 additions & 31 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -20,8 +20,11 @@ Before you can enable RDP Shortpath, you'll need to meet the prerequisites. Sele
20
20
# [Managed networks](#tab/managed-networks)
21
21
22
22
- A client device running the [Remote Desktop client for Windows](users/connect-windows.md), version 1.2.3488 or later. Currently, non-Windows clients aren't supported.
23
+
23
24
- Direct line of sight connectivity between the client and the session host. Having direct line of sight connectivity means that the client can connect directly to the session host on port 3390 (default) without being blocked by firewalls (including the Windows Firewall) or Network Security Group, and using a managed network such as:
- Site-to-site or Point-to-site VPN (IPsec), such as [Azure VPN Gateway](../vpn-gateway/vpn-gateway-about-vpngateways.md).
26
29
27
30
# [Public networks](#tab/public-networks)
@@ -30,8 +33,13 @@ Before you can enable RDP Shortpath, you'll need to meet the prerequisites. Sele
30
33
> RDP Shortpath for public networks with STUN or TURN will work automatically without any additional configuration, providing networks and firewalls allow the traffic through and RDP transport settings in the Windows operating system for session hosts and clients are using their default values. The steps to configure RDP Shortpath for public networks are provided for session hosts and clients in case these defaults have been changed.
31
34
32
35
- A client device running the [Remote Desktop client for Windows](users/connect-windows.md), version 1.2.3488 or later. Currently, non-Windows clients aren't supported.
33
-
- Internet access for both clients and session hosts. Session hosts require outbound UDP connectivity from your session hosts to the internet or connections to STUN and TURN servers. To reduce the number of ports required, you can [limit the port range used by clients for public networks](configure-rdp-shortpath-limit-ports-public-networks.md). For more information you can use to configure firewalls and Network Security Groups, see [Network configurations for RDP Shortpath](rdp-shortpath.md#network-configuration).
36
+
37
+
- Internet access for both clients and session hosts. Session hosts require outbound UDP connectivity from your session hosts to the internet or connections to STUN and TURN servers. To reduce the number of ports required, you can [limit the port range used by clients for public networks](configure-rdp-shortpath-limit-ports-public-networks.md).
38
+
39
+
RDP Shortpath doesn't support Symmetric NAT. For more information you can use to configure firewalls and Network Security Groups, see [Network configurations for RDP Shortpath](rdp-shortpath.md?tabs=public-networks#network-configuration).
40
+
34
41
- Check your client can connect to the STUN and TURN endpoints and verify that basic UDP functionality works by running the executable `avdnettest.exe`. For steps of how to do this, see [Verifying STUN/TURN server connectivity and NAT type](troubleshoot-rdp-shortpath.md#verifying-stunturn-server-connectivity-and-nat-type).
42
+
35
43
- To use TURN, the connection from the client must be within a supported location. For a list of Azure regions that TURN is available, see [supported Azure regions with TURN availability](rdp-shortpath.md#turn-availability-preview).
36
44
37
45
> [!IMPORTANT]
@@ -51,14 +59,12 @@ To enable RDP Shortpath for managed networks, you need to enable the RDP Shortpa
51
59
52
60
1. Download the [Azure Virtual Desktop administrative template](https://aka.ms/avdgpo) and extract the contents of the .cab file and .zip archive.
53
61
54
-
1. Depending on whether you want to configure Group Policy centrally from your domain, or locally for each session host:
55
-
56
-
**AD Domain**:
57
-
1. Copy and paste the **terminalserver-avd.admx** file to the Central Store for your domain, for example `\\contoso.com\SYSVOL\contoso.com\policies\PolicyDefinitions`, where *contoso.com* is your domain name. Then copy the **en-us\terminalserver-avd.adml** file to the `en-us` subfolder.
62
+
1. Depending on whether you want to configure Group Policy centrally from your AD domain, or locally for each session host:
63
+
64
+
1.**AD Domain**: Copy and paste the **terminalserver-avd.admx** file to the Central Store for your domain, for example `\\contoso.com\SYSVOL\contoso.com\policies\PolicyDefinitions`, where *contoso.com* is your domain name. Then copy the **en-us\terminalserver-avd.adml** file to the `en-us` subfolder.
58
65
1. Open the **Group Policy Management Console** (GPMC) and create or edit a policy that targets your session hosts.
59
66
60
-
**Locally**:
61
-
1. Copy and paste the **terminalserver-avd.admx** file to `%windir%\PolicyDefinitions`. Then copy the **en-us\terminalserver-avd.adml** file to the `en-us` subfolder.
67
+
1.**Locally**: Copy and paste the **terminalserver-avd.admx** file to `%windir%\PolicyDefinitions`. Then copy the **en-us\terminalserver-avd.adml** file to the `en-us` subfolder.
62
68
1. Open the **Local Group Policy Editor** on the session host.
63
69
64
70
1. Browse to **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Remote Desktop Services** > **Remote Desktop Session Host** > **Azure Virtual Desktop**. You should see policy settings for Azure Virtual Desktop, as shown in the following screenshot:
@@ -67,10 +73,9 @@ To enable RDP Shortpath for managed networks, you need to enable the RDP Shortpa
67
73
68
74
1. Open the policy setting **Enable RDP Shortpath for managed networks** and set it to **Enabled**. If you enable this policy setting, you can also configure the port number that Azure Virtual Desktop session hosts will use to listen for incoming connections. The default port is **3390**.
69
75
70
-
1. If you need to configure Windows Firewall to allow port 3390, run one of the following commands, depending on whether you want to configure Windows Firewall using Group Policy centrally from your domain, or locally for each session host:
76
+
1. If you need to configure Windows Firewall to allow port 3390, run one of the following commands, depending on whether you want to configure Windows Firewall using Group Policy centrally from your AD domain, or locally for each session host:
71
77
72
-
**AD Domain**:
73
-
1. Open an elevated PowerShell prompt and run the following command, replacing the value for `$domainName` with your own domain name, the value for `$writableDC` with the hostname of a writeable domain controller, and the value for `$policyName` with the name of an existing Group Policy Object:
78
+
1.**AD Domain**: Open an elevated PowerShell prompt and run the following command, replacing the value for `$domainName` with your own domain name, the value for `$writableDC` with the hostname of a writeable domain controller, and the value for `$policyName` with the name of an existing Group Policy Object:
74
79
75
80
```powershell
76
81
$domainName = "contoso.com"
@@ -83,8 +88,7 @@ To enable RDP Shortpath for managed networks, you need to enable the RDP Shortpa
83
88
Save-NetGPO -GPOSession $gpoSession
84
89
```
85
90
86
-
**Locally**:
87
-
1. Open an elevated PowerShell prompt and run the following command:
91
+
1. **Locally**: Open an elevated PowerShell prompt and run the following command:
@@ -96,13 +100,11 @@ To enable RDP Shortpath for managed networks, you need to enable the RDP Shortpa
96
100
97
101
If you need to configure session hosts and clients to enable RDP Shortpath for public networks because their default settings have been changed, follow these steps. You can do this using Group Policy, either centrally from your domain for session hosts that are joined to an Active Directory (AD) domain, or locally for session hosts that are joined to Azure Active Directory (Azure AD).
98
102
99
-
1. Depending on whether you want to configure Group Policy centrally from your domain, or locally for each session host:
100
-
101
-
**AD Domain**:
102
-
1. Open the **Group Policy Management Console** (GPMC) and create or edit a policy that targets your session hosts.
103
+
1. Depending on whether you want to configure Group Policy centrally from your AD domain, or locally for each session host:
104
+
105
+
1. **AD Domain**: Open the **Group Policy Management Console** (GPMC) and create or edit a policy that targets your session hosts.
103
106
104
-
**Locally**:
105
-
1. Open the **Local Group Policy Editor** on the session host.
107
+
1. **Locally**: Open the **Local Group Policy Editor** on the session host.
@@ -139,7 +143,7 @@ To configure managed Windows clients using Intune:
139
143
140
144
1. Sign in to the [Endpoint Manager admin center](https://endpoint.microsoft.com/).
141
145
142
-
1. Create or edit a configuration profile for **Windows 10 and later** devices, using Administrative templates.
146
+
1. [Create or edit a configuration profile](/mem/intune/configuration/administrative-templates-windows) for **Windows 10 and later** devices, using Administrative templates.
@@ -213,8 +217,11 @@ If you're using [Azure Log Analytics](./diagnostics-log-analytics.md), you can m
213
217
The possible values are:
214
218
215
219
-**1** - The user connection is using RDP Shortpath for managed networks.
220
+
216
221
-**2** - The user connection is using RDP Shortpath for public networks directly using STUN.
222
+
217
223
-**4** - The user connection is using RDP Shortpath for public networks indirectly using TURN.
224
+
218
225
- For any other value, the user connection isn't using RDP Shortpath and is connected using TCP.
219
226
220
227
The following query lets you review connection information. You can run this query in the [Log Analytics query editor](../azure-monitor/logs/log-analytics-tutorial.md#write-a-query). For each query, replace `[email protected]` with the UPN of the user you want to look up.
@@ -254,12 +261,10 @@ To disable RDP Shortpath for managed networks on your session hosts, you need to
254
261
Alternatively, you can block port **3390** (default) to your session hosts on a firewall or Network Security Group.
255
262
256
263
1. Depending on whether you want to configure Group Policy centrally from your domain, or locally for each session host:
257
-
258
-
**AD Domain**:
259
-
1. Open the **Group Policy Management Console** (GPMC) and edit the existing policy that targets your session hosts.
260
264
261
-
**Locally**:
262
-
1. Open the **Local Group Policy Editor** on the session host.
265
+
1.**AD Domain**: Open the **Group Policy Management Console** (GPMC) and edit the existing policy that targets your session hosts.
266
+
267
+
1.**Locally**: Open the **Local Group Policy Editor** on the session host.
263
268
264
269
1. Browse to **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Remote Desktop Services** > **Remote Desktop Session Host** > **Azure Virtual Desktop**. You should see policy settings for Azure Virtual Desktop providing you have the administrative template from when you enabled RDP Shortpath for managed networks.
265
270
@@ -277,12 +282,10 @@ To disable RDP Shortpath for public networks on your session hosts, you can set
277
282
Alternatively, if you want to disable RDP Shortpath for public networks only, you'll need to block access to the STUN endpoints on a firewall or Network Security Group. The IP addresses for the STUN endpoints can be found in the table for [Session host virtual network](rdp-shortpath.md#session-host-virtual-network).
278
283
279
284
1. Depending on whether you want to configure Group Policy centrally from your domain, or locally for each session host:
280
-
281
-
**AD Domain**:
282
-
1. Open the **Group Policy Management Console** (GPMC) and edit the existing policy that targets your session hosts.
283
285
284
-
**Locally**:
285
-
1. Open the **Local Group Policy Editor** on the session host.
286
+
1.**AD Domain**: Open the **Group Policy Management Console** (GPMC) and edit the existing policy that targets your session hosts.
287
+
288
+
1.**Locally**: Open the **Local Group Policy Editor** on the session host.
@@ -298,13 +301,15 @@ On client devices, you can disable RDP Shortpath for managed networks and public
298
301
299
302
> [!IMPORTANT]
300
303
> If you have previously set RDP traffic to attempt to use both TCP and UDP protocols using Group Policy or Intune, ensure the settings don't conflict.
301
-
>
304
+
302
305
#### Disable RDP Shortpath on managed and unmanaged Windows clients using Group Policy
303
306
304
307
To configure managed and unmanaged Windows clients using Group Policy:
305
308
306
309
1. Depending on whether you want to configure managed or unmanaged clients:
310
+
307
311
1. For managed clients, open the **Group Policy Management Console** (GPMC) and create or edit a policy that targets your clients.
312
+
308
313
1. For unmanaged clients, open the **Local Group Policy Editor** on the client.
@@ -319,7 +324,7 @@ To configure managed Windows clients using Intune:
319
324
320
325
1. Sign in to the [Endpoint Manager admin center](https://endpoint.microsoft.com/).
321
326
322
-
1. Create or edit a configuration profile for **Windows 10 and later** devices, using Administrative templates.
327
+
1.[Create or edit a configuration profile](/mem/intune/configuration/administrative-templates-windows) for **Windows 10 and later** devices, using Administrative templates.
![prmerger-automator[bot]](https://avatars.githubusercontent.com/u/22479449?v=4&size=40){kind=avatar}
0 commit comments