PingOne Privilege

Configuring remote desktop access

When you onboard a cloud account, PingOne Privilege automatically discovers all Remote Desktop Protocol (RDP) instances, which are then listed as targets. To enable passwordless access to these targets, you must configure an access method based on whether the target machine is or isn’t joined to an Active Directory (AD) domain.

Before you begin

To set up remote desktop access, ensure you have either a Private Proxy or a Relay, configured under Directory > Gateways.

Step 1: Create RDP user management

Choose one of the following methods depending on your target environment.

Method A: For Non-Domain-Joined Machines

For standalone Windows servers, use the Local User mode to store and manage a local administrator account.

  1. In the PingOne Privilege admin console, go to Connections > RDP User Management.

  2. Click Create.

  3. Enter a Name for this configuration, such as Standalone Web Servers.

    • If you select Password as your Authentication Type, follow these steps:

      1. Enable the Local User Mode toggle.

      2. In the Admin Username and Admin Password fields, enter the credentials for a local administrator account on the target machine.

      3. (Optional) Enable the Rotate Passwords feature.

      4. For each standard domain user account you want to manage, enter their Username / Password.

      5. Click the blue User icon.

      6. In the Select User window, associate the user with their credentials.

        These credentials are securely stored in the PingOne Privilege vault.

    • If you select Smart Card as your Authentication Type, follow these steps:

      1. In the Username field enter the username for a local administrator account on the target machine.

      2. Click the blue User icon.

      3. In the Select User window, associate the user with their credentials.

  4. To make the domain controller configuration the default for RDP targets in that cloud provider, select the Cloud Type

    • AWS

    • AZURE

    • GCP

    • PRIVATE

  5. Click Create.

Method B: For Domain-Joined Machines

For Windows servers joined to an Active Directory domain, create a configuration that stores domain credentials.

  1. In the PingOne Privilege admin console, go to Connections > RDP User Management.

  2. Click Create.

  3. Enter a Name for this configuration, such as Corporate AD Domain.

    • If you select Password as your Authentication Type, follow these steps:

      1. Ensure the Local User Mode toggle is disabled.

      2. Enter the Admin Username and Admin Password for a privileged Domain Admin account.

        This service account is used by PingOne Privilege to manage other users' passwords within the domain.

      3. (Optional) Enable the Rotate Passwords feature.

      4. For each standard domain user account you want to manage, enter their Username / Password.

      5. Click the blue User icon.

      6. In the Select User window, associate the user with their credentials.

        Use user@domain as the username for the domain account.

    • If you select Smart Card as your Authentication Type, follow these steps:

      1. In the Username field enter the username for a local administrator account on the target machine.

        Use user@domain as the username for the domain account.

      2. Click the blue User icon.

      3. In the Select User window, associate the user with their credentials.

  4. To make the domain controller configuration the default for RDP targets in that cloud provider, select the Cloud Type

    • AWS

    • AZURE

    • GCP

    • PRIVATE

  5. Click Create.

Step 2: Bind the RDP instance to the configuration

After creating a configuration, you must bind each RDP target to it.

  1. In the PingOne Privilege admin console, go to Cloud > Targets.

  2. Find the target RDP instance and click More Info.

  3. From the RDP User Management list, select the configuration you created in the previous step.

  4. Enable the Managed toggle for the RDP instance. Click Save.

  5. Click Create.