{"id":5000,"date":"2025-03-18T17:47:59","date_gmt":"2025-03-18T16:47:59","guid":{"rendered":"https:\/\/mortenknudsen.net\/?p=5000"},"modified":"2025-03-18T17:55:41","modified_gmt":"2025-03-18T16:55:41","slug":"how-to-authenticate-with-windows-hello-for-business-or-fido-security-key-in-rdp-session","status":"publish","type":"post","link":"https:\/\/mortenknudsen.net\/?p=5000","title":{"rendered":"How to authenticate with Windows Hello for Business or FIDO security key in RDP session ?"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">This little guide will show how you can authenticate with Windows Hello for Business and FIDO2 security key in a RDP session. Let&#8217;s get rid of those passwords !<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Content<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"#video\" data-type=\"internal\" data-id=\"#video\">Demo Video of Authentication with WHfB and FIDO in RDP session<\/a><\/li>\n\n\n\n<li><a href=\"#client\" data-type=\"internal\" data-id=\"#client\">Windows Client with FIDO passkey (picture)<\/a><\/li>\n\n\n\n<li><a href=\"#support\" data-type=\"internal\" data-id=\"#support\">Supported Platforms<\/a><\/li>\n\n\n\n<li><a href=\"#mstsc\" data-type=\"internal\" data-id=\"#mstsc\">How to enable with Remote Desktop Connection (MSTSC) or similar remote connection tool<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/learn.microsoft.com\/en-us\/azure\/virtual-desktop\/redirection-configure-webauthn?tabs=intune&amp;pivots=azure-virtual-desktop\" data-type=\"link\" data-id=\"https:\/\/learn.microsoft.com\/en-us\/azure\/virtual-desktop\/redirection-configure-webauthn?tabs=intune&amp;pivots=azure-virtual-desktop\">How to enable on Azure Virtual Desktop &#8211; AVD (Microsoft Learn article)<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/learn.microsoft.com\/en-us\/azure\/virtual-desktop\/redirection-configure-webauthn?tabs=intune&amp;pivots=windows-365\" data-type=\"link\" data-id=\"https:\/\/learn.microsoft.com\/en-us\/azure\/virtual-desktop\/redirection-configure-webauthn?tabs=intune&amp;pivots=windows-365\">How to enable on Windows 365 (Microsoft Learn article)<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/learn.microsoft.com\/en-us\/azure\/virtual-desktop\/redirection-configure-webauthn?tabs=intune&amp;pivots=dev-box\">How to enable on Microsoft Dev Box (Microsoft Learn article)<\/a><\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"video\">Demo Video of Authentication with WHfB and FIDO in RDP session<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Setup is based on Azure VM (AD hybrid-joined Windows Server 2022), which I&#8217;m accessing from my home computer (Windows 11, Entra ID-Joined) using RDP session. I&#8217;m using Windows Hello for Business Kerberos Trust and FIDO2 security key in the demo to sign-in.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<figure class=\"wp-block-embed is-type-video is-provider-youtube wp-block-embed-youtube wp-embed-aspect-4-3 wp-has-aspect-ratio\"><div class=\"wp-block-embed__wrapper\">\n<iframe loading=\"lazy\" title=\"Demo of authenticating with WHFB and FIDO Passkey in a RDP session\" width=\"1200\" height=\"900\" src=\"https:\/\/www.youtube.com\/embed\/UeCOLbRvRfQ?feature=oembed&#038;enablejsapi=1\" frameborder=\"0\" allow=\"accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share\" referrerpolicy=\"strict-origin-when-cross-origin\" allowfullscreen><\/iframe>\n<\/div><figcaption class=\"wp-element-caption\">Demo #1 shows a Windows Hello for Business with Facial Recognition login in the RDP session. Demo #2 shows a Security Key (FIDO2 key) login in the RDP session. Hardware from my local computer is accessible in the RDP session using Web Authentication. <\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"client\">Windows Client with FIDO passkey (picture)<\/h4>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"768\" height=\"1024\" src=\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2025\/03\/IMG_8157-768x1024.jpg\" alt=\"\" class=\"wp-image-5001\" srcset=\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2025\/03\/IMG_8157-768x1024.jpg 768w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2025\/03\/IMG_8157-225x300.jpg 225w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2025\/03\/IMG_8157-1152x1536.jpg 1152w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2025\/03\/IMG_8157-1536x2048.jpg 1536w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2025\/03\/IMG_8157-scaled.jpg 1920w\" sizes=\"auto, (max-width: 768px) 100vw, 768px\" \/><figcaption class=\"wp-element-caption\">RDP Session can use Windows Hello for Business and FIDO2 coming from my local computer in the RDP session. In this example, I&#8217;m using a Feitian K40 FIDO2 passkey in my home computer. <\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"support\">Supported Platforms<\/h2>\n\n\n\n<figure class=\"wp-block-table\"><table><tbody><tr><td>Support \/ Platform<\/td><td>Windows Clients<\/td><td>Windows Servers<\/td><\/tr><tr><td>Supported<\/td><td>Windows 11 22H2 and higher<br>Windows 10 22H2 and higher<\/td><td>Windows 2025<br>Windows 2022<\/td><\/tr><tr><td>Unsupported<\/td><td><\/td><td>Windows 2019<br>Windows 2016<br>Windows 2012 R2<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"mstsc\">How to enable feature with Remote Desktop Connection (MSTSC) or similar remote connection tool<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">You just have to enable <strong>Web Authentication<\/strong> in both the <strong>RDP Session Host<\/strong> (Windows Server\/Client acting as host\/target) and <strong>Client<\/strong> (guest, which you are connecting with\/source).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Below are 2 methods shown; AD Group Policy and Intune.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<h4 class=\"wp-block-heading\">AD Group Policy<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">If you don&#8217;t see all below policies, download <a href=\"https:\/\/www.microsoft.com\/en-us\/download\/details.aspx?id=106254\" data-type=\"link\" data-id=\"https:\/\/www.microsoft.com\/en-us\/download\/details.aspx?id=106254\">Windows 11 24H2 Administrative Templates<\/a> and <a href=\"https:\/\/learn.microsoft.com\/en-us\/troubleshoot\/windows-client\/group-policy\/create-and-manage-central-store\" data-type=\"link\" data-id=\"https:\/\/learn.microsoft.com\/en-us\/troubleshoot\/windows-client\/group-policy\/create-and-manage-central-store\">copy the ADMx\/ADMl files into PolicyDefinition using this guide<\/a>. <\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"802\" height=\"770\" src=\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2025\/03\/image-9.png\" alt=\"\" class=\"wp-image-5004\" srcset=\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2025\/03\/image-9.png 802w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2025\/03\/image-9-300x288.png 300w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2025\/03\/image-9-768x737.png 768w\" sizes=\"auto, (max-width: 802px) 100vw, 802px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Windows Client Policy via Microsoft Intune<\/h4>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"530\" height=\"1024\" src=\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2025\/03\/image-8-530x1024.png\" alt=\"\" class=\"wp-image-5003\" srcset=\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2025\/03\/image-8-530x1024.png 530w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2025\/03\/image-8-155x300.png 155w, https:\/\/mortenknudsen.net\/wp-content\/uploads\/2025\/03\/image-8.png 622w\" sizes=\"auto, (max-width: 530px) 100vw, 530px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">How to enable on AVD \/ Windows 365 \/ Microsoft Dev Box<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\" id=\"avd\"><a href=\"https:\/\/learn.microsoft.com\/en-us\/azure\/virtual-desktop\/redirection-configure-webauthn?tabs=intune&amp;pivots=azure-virtual-desktop\" data-type=\"link\" data-id=\"https:\/\/learn.microsoft.com\/en-us\/azure\/virtual-desktop\/redirection-configure-webauthn?tabs=intune&amp;pivots=azure-virtual-desktop\">How to enable on Azure Virtual Desktop &#8211; AVD (Microsoft Learn article)<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\" id=\"w365\"><a href=\"https:\/\/learn.microsoft.com\/en-us\/azure\/virtual-desktop\/redirection-configure-webauthn?tabs=intune&amp;pivots=windows-365\" data-type=\"link\" data-id=\"https:\/\/learn.microsoft.com\/en-us\/azure\/virtual-desktop\/redirection-configure-webauthn?tabs=intune&amp;pivots=windows-365\">How to enable on Windows 365 (Microsoft Learn article)<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\" id=\"DevBox\"><a href=\"https:\/\/learn.microsoft.com\/en-us\/azure\/virtual-desktop\/redirection-configure-webauthn?tabs=intune&amp;pivots=dev-box\">How to enable on Microsoft Dev Box (Microsoft Learn article)<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n","protected":false},"excerpt":{"rendered":"<p>This little guide will show how you can authenticate with Windows Hello for Business and FIDO2 security key in a &#8230; <\/p>\n<p class=\"read-more-container\"><a title=\"How to authenticate with Windows Hello for Business or FIDO security key in RDP session ?\" class=\"read-more button\" href=\"https:\/\/mortenknudsen.net\/?p=5000#more-5000\" aria-label=\"Read more about How to authenticate with Windows Hello for Business or FIDO security key in RDP session ?\">Read more<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"_uf_show_specific_survey":0,"_uf_disable_surveys":false,"ngg_post_thumbnail":0,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[161,163,164,160,133,134,132,159],"tags":[],"class_list":["post-5000","post","type-post","status-publish","format-standard","hentry","category-entra-id","category-identity","category-identity-2","category-intune","category-microsoft-security","category-mvpbuzz","category-security","category-windows-hello-for-business","infinite-scroll-item"],"featured_image_src":null,"author_info":{"display_name":"Morten Knudsen","author_link":"https:\/\/mortenknudsen.net\/?author=1"},"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack_likes_enabled":true,"_links":{"self":[{"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=\/wp\/v2\/posts\/5000","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=5000"}],"version-history":[{"count":3,"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=\/wp\/v2\/posts\/5000\/revisions"}],"predecessor-version":[{"id":5007,"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=\/wp\/v2\/posts\/5000\/revisions\/5007"}],"wp:attachment":[{"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=5000"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=5000"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=5000"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}