Blog Post

Core Infrastructure and Security Blog
6 MIN READ

Passwordless RDP with Windows Hello for Business

parobinson's avatar
parobinson
Icon for Microsoft rankMicrosoft
May 04, 2022
  Windows Hello for Business (WHfB) provides a password-less experience for users to log into their Windows 10 or 11 device. However, a challenge remains when accessing remote systems. This can be ...
Updated May 09, 2022
Version 3.0
PaulRobinson
C-Money's avatar
C-Money
Copper Contributor
Dec 11, 2022

Has anyone gotten this to work with Remote Desktop Gateway? I'm using Key Trust (I need certs on my domain controllers for LDAPS, and the 30 minute Azure AD Connect lag doesn't bother me) and I've tried everything I could think to try and it just won't work. It won't even work when I have line of sight to a Domain Controller (I also have KDC Proxy up and running too, no difference.) According to this article (https://cloudbrothers.info/en/windows-business-cloud-trust-kdc-proxy/) " HttpsClientAuth must be set to 0 otherwise the all connections will fail, even when the Windows Hello for Business certificate is replicated to the on-prem AD. This is because the root certificate of this certificate (e.g. MS-Organization-P2P-Access [2022]) is not trusted by the KDC proxy server and a validation is not possible.

 

I assume that if KDC Proxy won't authenticate because of this, that is also why Remote Desktop Gateway doesn't work because they both use the netsh http system?