Using new Windows 11 RDP parameters redirectwebauthn and enablerdsaadauth with MsTscAx

Question

Windows 11 has added two parameters to the RDP files for the in-box RDP client MsTsc.exe. How can these be enabled in MsTscAx, the ActiveX plugin?
• redirectwebauthn:i:value
• enablerdsaadauth:i:value

https://learn.microsoft.com/en-us/windows-server/remote/remote-desktop-services/clients/rdp-files
Also, is there any way for a program to pass the RDSAAD token into MsTscAx?

Answer 1

I don't work for Microsoft, but I reverse engineered what mstsc does for "redirectwebauthn". The code logic looks like this:

if (CTscSettings::GetWebAuthnRedirection()) {  
    WebAuthnRedirConfig::GetWebAuthnRedirDynVCPluginPath()  
    IMsTscAdvancedSettings::PluginDlls()  
}  

There's a webauthn plugin registered - see more info here https://learn.microsoft.com/en-us/windows/win32/termserv/dvc-plug-in-registration
and here https://learn.microsoft.com/en-us/windows/win32/termserv/imstscadvancedsettings-plugindlls

You can obtain the webauthn plugin dll path this way:

Get-ItemPropertyValue -Path "HKLM:\SOFTWARE\Microsoft\Terminal Server Client\Default\AddIns\webauthn" -Name "Name"

The default value is "C:\WINDOWS\System32\webauthn.dll"

Beyond this, there is a registry key to disable WebAuthn redirection globally:

Set-ItemPropertyValue -Path "HKLM:\SOFTWARE\Microsoft\Terminal Server Client" -Name "DisableWebAuthnRedirection" -Value 1
Get-ItemPropertyValue -Path "HKLM:\SOFTWARE\Microsoft\Terminal Server Client" -Name "DisableWebAuthnRedirection"

I hope this helps. As for enablerdsaadauth:i:1 I have done a lot of Azure Virtual Desktop reversing, and I really doubt it's possible to make it work outside of AVD. You would also need to use rdclientax.dll instead of mstscax.dll, but even then, I couldn't manage to get an AVD connection done through the RDP ActiveX interface.

https://blog.devolutions.net/2022/08/extending-the-microsoft-rdp-client-with-api-hooking/

Please let me know if you do make some progress on that front though!

Cheers

Answer 2

I spoke too fast with regards to enablerdsaadauth:i:1 - it's documented as supported for regular RDP connections outside of AVD, and should enable the newer Azure AD SSO feature that doesn't rely on CredSSP+PKU2U for Azure AD accounts: https://learn.microsoft.com/en-us/windows-server/remote/remote-desktop-services/clients/rdp-files

There is a new "EnableRdsAadAuth" BOOL property you can set through IMsRdpExtendedSettings

Hopefully just setting to true will be enough to make it work through the RDP ActiveX. As for manually injecting the RDS AAD tokens, there appears to be internal COM interfaces that deal with it, but I don't think they're documented or officially exposed externally: