Recorded remote desktop (RDP) sessions

Recorded remote desktop sessions extend privileged access to Windows servers and to Linux servers that run xrdp. The person opens the desktop in the browser; the gateway connects to the server and types the credential itself, so the person never sees it.

Is it available?

Not yet. The RDP connection engine is in the product and tested against xrdp, but the gateway broker, the browser client and the player are still in development. Today privileged access offers SSH sessions and credential checkout.

How will a session work?

1. You register the server as a target and confirm its certificate key, as you do for an SSH host key: the gateway trusts only that key from then on.
2. The person requests the account under «Access» › «My access». Approval follows the account's access profile.
3. Once the access is active, the person opens the remote desktop in a browser tab.
4. The gateway connects with Network Level Authentication (NTLM inside TLS) or, for xrdp, TLS sign-in, using the vaulted credential or a temporary local account created for this access.

What is recorded and controlled?

• The screen is recorded, encrypted and sealed like an SSH recording, with an index of the keystroke bursts so that you can jump to them in the player.
• Administrators can watch a session live and end it.
• The text clipboard is off by default. When a profile allows it, text goes to the server only, and the recording keeps its length and digest, not its content.
• Drives, printers, audio, smart cards and USB devices are never redirected.

What are the limits?

RDP uses classical cryptography. It is not a post-quantum protocol, so the leg between the gateway and the server should stay inside your network.

How do I prepare?

• Make sure the gateway or the Edge appliance can reach port 3389 of the servers.
• Decide which accounts are vaulted and which should be temporary local accounts.
• Review the access profiles: duration, approvals and whether the clipboard is allowed.