> For the complete documentation index, see [llms.txt](https://docs.plenit.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.plenit.com/docs-en/productos/remote-desktop/how-to/como-configurar-2fa-a-los-usuarios-de-escritorio-remoto.md).

# How to Configure 2FA for Remote Desktop Users

Two-factor authentication (2FA) adds a layer of security to access: in addition to their username and password, the person needs a temporary code generated by an app on their mobile phone that changes frequently. That way, even if someone saw the code, it would stop working within minutes.

This guide has two parts: the activation you do as administrator, and the registration completed by the user.

> #### 👍 What you get
>
> 2FA enabled for a Remote Desktop user, and the user registered in their authenticator app to access with a temporary code.

### Before you start

* Access the administration panel at [admin.plenit.com](https://admin.plenit.com) with permissions on the environment.
* Have an active Remote Desktop subscription. If you don't already have one, set it up with the [Remote Desktop Quick Start.](/docs-en/productos/remote-desktop/quickstart.md)
* That the user has a smartphone with an authenticator app installed: Google Authenticator or Microsoft Authenticator.

> #### 📘 One 2FA for all your environments
>
> If a user has access to more than one Remote Desktop, a single 2FA is enough to access all of them. They do not need to register one per environment.

### Step 1. Activate the user's 2FA (administrator)

In [admin.plenit.com](https://admin.plenit.com), go to **Cloud Services → Remote Desktop** and enter the environment subscription. Open the **Users**, select the server you are going to work on, find the user, and check their **2FA check**.

{/\* 📸 CAPTURE 1 · Users · server, user and 2FA check \*/}

![Activation of the 2FA check on the user](https://REEMPLAZA-URL/escritorio-remoto-2fa-01.png)

A notice about 2FA activation appears. Press **Confirm** to continue. The check turns green, indicating that 2FA is enabled for that user.

{/\* 📸 CAPTURE 2 · activation notice · Confirm button \*/}

![Confirmation of 2FA activation](https://REEMPLAZA-URL/escritorio-remoto-2fa-02.png)

That concludes your part. The user completes the rest on their next access.

### Step 2. Registration in the authenticator app (user)

The next time the user enters their Remote Desktop, with the authenticator app open on their mobile phone, they will see a screen with two ways to register. They only need one:

* **Alphanumeric key**: they enter it manually in the app to register the access.
* **QR code**: they scan it with the app to register the access.

After registering through either method, press **Confirm**. From then on, the app will show the temporary access code.

{/\* 📸 CAPTURE 3 · screen with alphanumeric key and QR to register the app \*/}

![User registration with alphanumeric key or QR code](https://REEMPLAZA-URL/escritorio-remoto-2fa-03.png)

> 📘 If the user is on a server and load balancer
>
> When the user is registered on a server and, in addition, on the load balancer, they will see an option to choose where to connect. If they are only on a server or only on the load balancer, they do not have to choose.

Then, the user chooses the connection method: **HTML5** if they enter through the browser, or **RemoteApp** if they prefer the client (this requires downloading a plugin and, therefore, administrator permissions on their computer). Press **Connect** to start the connection.

Finally, in the validation window, enter the **authentication code** shown by the app, and log in.

{/\* 📸 CAPTURE 4 · validation window · enter the app code \*/}

![Entering the authentication code](https://REEMPLAZA-URL/escritorio-remoto-2fa-04.png)

> #### 📘 Reconfigure 2FA later
>
> Once 2FA is activated, the user's profile in the Organization section includes two options: reconfigure the authenticator app by generating a new key, or generate one-time codes. These are useful if the user changes phones or loses access to the app.

### Conclusion

Activating 2FA is a quick change on your part — check the user's box in Users and confirm it — but its effect is completed by the user when they register the app on their phone with the key or QR code. From then on, every access requests the temporary code, and with a single 2FA it covers all the environments that user has access to.

If they ever lose access to the app, from their profile in Organization they can regenerate the key or request one-time codes.

### Next steps

* Strengthen access by avoiding open ports in [How to configure the ports of your Remote Desktop.](/docs-en/productos/remote-desktop/how-to/how-to-configure-remote-desktop-ports.md)
* Register or manage users in bulk with [bulk user import.](/docs-en/productos/remote-desktop/how-to/how-to-bulk-upload-users.md)
* Manage the rest of the environment from [How to manage your Remote Desktop environment.](/docs-en/productos/remote-desktop/how-to/how-to-administer-your-remote-desktop.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.plenit.com/docs-en/productos/remote-desktop/how-to/como-configurar-2fa-a-los-usuarios-de-escritorio-remoto.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.