Blog Post

Microsoft Security Community Blog
4 MIN READ

Introducing Microsoft RemoteFX USB Redirection: Part 1

MicrosoftSecurityandComplianceTeam's avatar
Sep 08, 2018
First published on CloudBlogs on Jun, 10 2010

In April, Max Herrmann posted a blog article announcing our newest device redirection feature for Remote Desktop Virtualization Host: RemoteFX USB redirection. In this three-part series, we’ll take a closer look at the feature and how it helps close the gap between the user experience of a local user sitting at their physical desktop and that of a remote user connected to a virtual desktop. The first part of the series gives an overview of the feature and what it can do, and how to set up a basic deployment of the feature.

Feature Overview

The goal of RemoteFX USB redirection is simple: the user should be able to use any device they want, and have it just work . RDP has numerous high-level redirections that allow specific types of devices to be used effectively in a remote session, such as:

  • Easy Print, which allows users to print to local printers in remote sessions
  • Drive Redirection, which allows users to access the file system on any local drive in a remote session, including USB drives
  • Smart Card Redirection, which allows users to authenticate to and in a remote session by using smart cards/e-tokens
  • Plug-and-Play Device Redirection, which allows users to access PTP digital cameras, MTP music players, and POS for .NET devices in a remote session, among others
  • Input Redirection, which allows the use of keyboards/mice in remote sessions
  • Audio Redirection, which allows recording and playback of audio in remote sessions
  • Port Redirection, which allows the use of serial and parallel ports in remote sessions

However, there are many devices which are not covered by these redirections, such as scanners, multifunction printers, webcams, and more. RemoteFX USB redirection acts as a catch-all mechanism that redirects these USB devices! Unlike high-level redirections such as drive redirection, RemoteFX USB redirection happens at the port protocol (USB request block or URB) level, and is similar to how one can redirect serial or parallel ports via RDP. This provides some unique advantages, as you’ll see below. However, RemoteFX USB redirection is meant to supplement high-level redirections, not to supplant them. By combining RemoteFX USB redirection with RDP high-level device redirections, you can have the best of both worlds. Here is a table that compares and contrasts the two forms of redirection.

RemoteFX USB Redirection…

RDP High-Level Device Redirection…

Does not require drivers on the client

Requires drivers for the device to be installed on the client

Requires the device driver to be installed on the server

Generally does not require drivers on the server

Uses one redirection method for many types of devices

Uses a specific, unique method for each type of device being redirected

Forwards URBs to and from the device over the RDP connection

Exposes high-level device functionality in the remote session by using an optimized protocol for the device type

Enables only one session to use a device at a given time; the local client cannot use the device while an RDP session is using it

Enables any number of sessions to access the device simultaneously, including the local client

Is optimized for the LAN, like the rest of RemoteFX

Works with both LAN and WAN

Setting up a Basic Deployment

Now that you’ve seen what RemoteFX USB redirection can do, let’s take a look at how to set up the feature.

Prerequisites

You will need the following:

  • A RemoteFX-capable client (Remote Desktop Connection 7.1 or later)
  • A virtual machine hosted on a RemoteFX host (Windows 7 SP1 or later)
Enabling RemoteFX USB redirection on the clients
  1. In order to redirect USB devices from a given machine, the RemoteFX USB redirection feature must be enabled. In Group Policy, navigate to Computer ConfigurationAdministrative TemplatesWindows ComponentsRemote Desktop ServicesRemote Desktop Connection ClientRemoteFX USB Device Redirection, and edit “Allow RDP redirection of other supported RemoteFX USB devices from this computer.” Enable the policy, and specify whether you wish to allow all users or only admins to redirect devices.
  2. On the client machines, run “gpupdate /force” (without quotes) from an Administrator command prompt to enable/disable the feature, and then restart the computer for the changes to take effect. The feature will not work until you restart.
Using the feature
  1. On the client, open Remote Desktop Connection. If the tabs are not listed, click Options to expand the dialog box.
  2. On the Local Resources tab, click More to display the Local devices and resources dialog box. If at least one supported RemoteFX USB device is connected, it should be listed in the device tree under Other supported RemoteFX USB devices .

    Note: The heading “Other supported RemoteFX USB devices” will only appear if the RemoteFX USB redirection feature is enabled on the client (apply the Group Policy setting, run gpupdate, and then restart) and at least one supported RemoteFX USB device is connected and available for redirection.
  3. After you are connected, the devices that you have selected should appear in the remote virtual desktop.

I hope you’ve enjoyed this first part in our series of blogs about RemoteFX USB redirection. In Part 2, we’re going to talk about some deployment-related topics, including setting up publishing and RD Web Access for rich and thin clients, and server device security. If you have any questions or comments, please post them to the blog, or send us an e-mail at rfxusb@microsoft.com . We look forward to hearing from you.

Published Sep 08, 2018
Version 1.0

9 Comments

  • Simon_Baltik's avatar
    Simon_Baltik
    Copper Contributor

    Hi Uli,

    The issue might be due to RemoteFX limitations, browser configurations, or WebAuthn restrictions over remote sessions.

    Ensure the browser supports WebAuthn and check for updates on the FIDO2 device and drivers.

    Also, verify group policy settings and WebAuthn compatibility with remote desktops.

     

    BR

    Simon

  • Simon_Baltik's avatar
    Simon_Baltik
    Copper Contributor

    Hi there,

    Thanks for this detailed guide, used this method, but sometimes it was like a rain dance.

    You should always keep in mind whether the version of Windows supports RemoteFX or OS's.

    It is not always convenient in the work process.

    It's half the trouble when you come across a USB device like a 3d mouse or some MFP device, here you need something more powerful and effective.

    For such situations, I found that using USB Network Gate (https://www.net-usb.com/) is a great alternative.

    Its allows for seamless USB redirection over RDP, making it easier to handle complex devices without worrying about compatibility issues with RemoteFX.

    It provides a more robust and efficient solution for remote USB device management.

    However, for most users, RemoteFX will probably be enough because it is also constantly updated.

  • DvMuthukumar's avatar
    DvMuthukumar
    Copper Contributor

    Allow audio and Video playback redirection should be disabled to redirect.

  • AR566's avatar
    AR566
    Copper Contributor

    For some reason I don't see it working.
    I am working with ws 2022 server side system
    and win 11 client side
    I enabled what you said on the client side, and on the server side I also enabled what I saw in the picture here
    But for some reason I don't see successful routing at all.
    Do I need to install something else on the server side?
    Thank you for the explanation

  • Mixdox's avatar
    Mixdox
    Copper Contributor

    I want to automatically enable and check the  “Other supported RemoteFX USB devices”  sub device, option

  • headmaster's avatar
    headmaster
    Copper Contributor

    hi,

    I have been trying different solutions to get the integrated webcam to work with RDP and Teams.

    This made it. Thanks!

     

    Best Regards

    Headmaster

  • Ulrich_Viefhaus's avatar
    Ulrich_Viefhaus
    Copper Contributor

    Hi,

    thanks for the article. I set up a remote system and a local system. Both with Windows 10.

    I can redirect a FIDO2 device via RemoteFX to the remote Windows. It is displayed in the device manager as HID compliant fido2 device. The windows key management settings also recognize it and can reset the PIN etc.

    But it is not possible to connect to any website with webauthn. They all get a "NotAllowedError".

    Do you have any idea, why Windows recognizes the token but can't use it for webauthn?

    Kind regards,

    Uli

  • TerrillMoore's avatar
    TerrillMoore
    Copper Contributor

    Scott1039I saw something similar; I had to reboot the server after making the group policy changes, then things worked.

  • Scott1039's avatar
    Scott1039
    Copper Contributor

    Dear

     

    Thanks for your sharing.
    I am trying to redirect webcam to remote desktop server. But not success.
    Client side is Win10 pro and server side is window server 2016 RDS.
    I did not get success by “RemoteFX USB Redirection” or “RDP High-Level Device Redirection”.
    Did you have any advice to continue check?
    Thanks for your valuable time.

    Below is client side settings.

     

     

    Below is server side