How to Configure 2FA for Remote Desktop Users
Enable two-factor authentication for a user from the panel and guide them through registering their authenticator app so they can sign in with a temporary code.
Two-factor authentication (2FA) adds a layer of security to access: in addition to their username and password, the person needs a temporary code generated by an app on their mobile phone that changes frequently. That way, even if someone saw the code, it would stop working within minutes.
This guide has two parts: the activation you do as administrator, and the registration completed by the user.
👍 What you get
2FA enabled for a Remote Desktop user, and the user registered in their authenticator app to access with a temporary code.
Before you start
Access the administration panel at admin.plenit.com with permissions on the environment.
Have an active Remote Desktop subscription. If you don't already have one, set it up with the Remote Desktop Quick Start.
That the user has a smartphone with an authenticator app installed: Google Authenticator or Microsoft Authenticator.
📘 One 2FA for all your environments
If a user has access to more than one Remote Desktop, a single 2FA is enough to access all of them. They do not need to register one per environment.
Step 1. Activate the user's 2FA (administrator)
In admin.plenit.com, go to Cloud Services → Remote Desktop and enter the environment subscription. Open the Users, select the server you are going to work on, find the user, and check their 2FA check.
{/* 📸 CAPTURE 1 · Users · server, user and 2FA check */}
A notice about 2FA activation appears. Press Confirm to continue. The check turns green, indicating that 2FA is enabled for that user.
{/* 📸 CAPTURE 2 · activation notice · Confirm button */}
That concludes your part. The user completes the rest on their next access.
Step 2. Registration in the authenticator app (user)
The next time the user enters their Remote Desktop, with the authenticator app open on their mobile phone, they will see a screen with two ways to register. They only need one:
Alphanumeric key: they enter it manually in the app to register the access.
QR code: they scan it with the app to register the access.
After registering through either method, press Confirm. From then on, the app will show the temporary access code.
{/* 📸 CAPTURE 3 · screen with alphanumeric key and QR to register the app */}
📘 If the user is on a server and load balancer
When the user is registered on a server and, in addition, on the load balancer, they will see an option to choose where to connect. If they are only on a server or only on the load balancer, they do not have to choose.
Then, the user chooses the connection method: HTML5 if they enter through the browser, or RemoteApp if they prefer the client (this requires downloading a plugin and, therefore, administrator permissions on their computer). Press Connect to start the connection.
Finally, in the validation window, enter the authentication code shown by the app, and log in.
{/* 📸 CAPTURE 4 · validation window · enter the app code */}
📘 Reconfigure 2FA later
Once 2FA is activated, the user's profile in the Organization section includes two options: reconfigure the authenticator app by generating a new key, or generate one-time codes. These are useful if the user changes phones or loses access to the app.
Conclusion
Activating 2FA is a quick change on your part — check the user's box in Users and confirm it — but its effect is completed by the user when they register the app on their phone with the key or QR code. From then on, every access requests the temporary code, and with a single 2FA it covers all the environments that user has access to.
If they ever lose access to the app, from their profile in Organization they can regenerate the key or request one-time codes.
Next steps
Strengthen access by avoiding open ports in How to configure the ports of your Remote Desktop.
Register or manage users in bulk with bulk user import.
Manage the rest of the environment from How to manage your Remote Desktop environment.
Last updated
Was this helpful?