Device Redirection tab missing from RDG?

Question

Wednesday, January 22, 2020 4:30 PM

I expect this may be my mistake and I'm more than happy to be corrected...but when configuring Remote Desktop Gateway policies on Windows Server 2019 I am missing the "Device Redirection" tab.  Its not available in the options anywhere.

Has that feature been removed from Windows Server 2019?

I would like to try and disable some device redirection settings...which seemed straightforward :-)

Thanks

All replies (8)

Thursday, January 23, 2020 4:08 PM âś…Answered | 1 vote

Hi,

On your NPS server, please use nps.msc to edit the RD CAP policy and add the Vendor specific attribute TSG-Device-Redirection via the Settings tab.  For the value, decide which options you want from list below, add them up, then convert to decimal.

  • 0x00000001     Disable Drive redirection
  • 0x00000008     Disable Clipboard
  • 0x00000002     Disable Printer redirection
  • 0x00000004     Disable Ports (COM and LPT only)
  • 0x00000010     Disable Supported Plug and Play devices
  • 0x08000000     Only allow client connections to Remote Desktop Session Host servers that enforce RD Gateway device redirection

For example, say you want to Disable Drive and Clipboard redirection.  That would be 0x1 + 0x8 + 0x8000000 = 0x8000009 = 134217737 (decimal)

Below article section walks through creation of RDG_CAP:

Integrate your Remote Desktop Gateway infrastructure using the Network Policy Server (NPS) extension and Azure AD

/en-us/azure/active-directory/authentication/howto-mfa-nps-extension-rdg#configure-network-policy

After making the above changes, please test to see if redirection is blocked for selected options.

Thanks.

-TP

Wednesday, January 22, 2020 4:54 PM

Hi,

If you open RD Gateway Manager, in left pane navigate to and select Policies\ Connection Authorization Policies, then right-click -- Properties on your RD CAP in the middle pane, are you saying the Device Redirection tab is missing?  If yes, please list the tabs that you do see.

Thanks.

-TP

Wednesday, January 22, 2020 5:04 PM

Thanks for the reply.

So I have...

RD Gateway Manager

     - MyServerName

             - Policies

                      - Central Network Policy Servers

                      - Resource Authorization policies

             - Monitoring

Under Policies, if I create a new RAP Policy, the only tabs I have are General | User Groups | Network Resource and Allowed Ports.  None of these tabs provide access to Device Redirection.

Wednesday, January 22, 2020 5:30 PM

Okay, based on what you've written it appears you have configured a central policy server, which is why you don't have the ability to Add/Edit RD CAPs in RD Gateway Manager.  Do you have a need for a central server, or can you switch back to local?

You make the switch by right-clicking on the server name in left pane -- Properties -- RD CAP Store tab.

-TP

Thursday, January 23, 2020 3:22 AM

HI
If you can not switch back to local ,did you consider deploying domain policy for your destination RDSH servers ?

Computer Configuration\ administrative templates\windows components\remote desktop services\remote desktop session host\device and resource redirection

Best Regards
Andy YOU
Please remember to mark the replies as answers if they help.
If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

Thursday, January 23, 2020 9:20 AM

Thanks for the replies.

@TP - Yes I will need to use the central policy server, the reason being the RDG is configured to use a dedicated NPS server (I'm using NPS Extension for Azure MFA).

@Andy - I had considered the GPO, the problem with this approach is that I need to restrict device redirection for certain teams only, but have this GPO apply to all computers.

Because the device redirection settings fall under the Computer Configuration, it means I cant apply this config to the Users I need to target.  I can apply the GPO to all computers or groups of computers, but it means all users that logon to these servers will inherit the same settings.  Which is not what I want.  I've looked at various ways to do this, including loopback processing, etc.

Thursday, January 23, 2020 4:28 PM

@TP - Thanks, that looks brilliant! I will give it ago tomorrow now as I have my hands full with something else.  I will report back.  cheers

Friday, January 24, 2020 11:14 AM

@TP - Thanks, that's done the trick!

I've disabled as much as possible while leaving printer mapping open.

So I've used...

  • 0x00000001     Disable Drive redirection
  • 0x00000008     Disable Clipboard
  • 0x00000004     Disable Ports (COM and LPT only)
  • 0x00000010     Disable Supported Plug and Play devices
  • 0x08000000     Only allow client connections to Remote Desktop Session Host servers that

0x1 + 0x8 + 0x4 + 0x10 + 0x8000000 = 0x800001D = 134217757

  • Last updated on