Home Lab Secrets: Securely Accessing your Home Lab from a Secure Space

  • Article

Purpose

 DISCLAIMER:  Any of the Method’s listed below, should be approved by your customer before use.

 The biggest issue with Secure Environments is the limited amount of ports that are allowed Outbound.  However I would guestimate that 99% of customers allow 443/TCP outbound.  All of the methods below leverage the use of 443/TCP Outbound.

 Overview

By leveraging Remote Desktop Services and Direct Access, any internal app can be made available via Desktop or Streamed Application and all over a secure port (443/TCP) session. Most environments have 443/TCP Outbound open so this should not be a problem. To support this you will need to setup one virtual machine with the following services:

 Active Directory Domain Services

  • Remote Desktop Services

 

Operating System:          Windows Server 2012

 

**To accommodate all technical levels, detailed instructions are listed below.  If you are familiar with a particular part of the setup then feel free to move on to the next step.

 

CONFIGURING THE VM

 Configuring the Computer Name

  1. Log onto the VM.

  2. When the Server Manager Dashboard opens click on Configure this local server.

  3. Under the Properties section click on the Computer name.

  4. On the Computer Name tab click the Change button.

  5. Under Computer name: enter [SERVERNAME OF YOUR CHOICE] then click OK.

     

    ***Note:  For the purposes of this lab the server will be named RDP-HOME-V

     

  6. At the Computer Name/Domain Changes screen click OK.

  7. Click Close to close the System Properties then click Restart Later.

 Configuring the IP Address

  1. Under the Properties section click on the Ethernet IP Address.

  2. Right-click Ethernet and select Properties.

  3. Highlight Internet Protocol Version 4 (TCP/IPv4) then click the Properties button.

  4. Select Use the following IP Address then enter the following:

    IP Address:         192.168.2.8        

    Subnet mask:    255.255.255.0

    Default Gateway:192.168.2.1      (This should be the IP of your router)

  5. Select Use the following DNS server addresses then enter the following:

    Preferred DNS server:192.168.2.8

  6. Click OK to close the Internet Protocol Version 4 (TCP/IPv4) Properties window.

  7. Click Close to close the Ethernet Properties window then close the Network Connections window.

 Installing Active Directory Domain Services and Remote Desktop Services

  1. In the Left-Pane of Server Manager click Dashboard.

  2. In the Right-Pane under Configure this local server click on Add roles and features.

  3. At the Before you begin screen click Next.

  4. At the Select installation type screen click Next.

  5. At the Select destination server screen click Next.

  6. At the Select server roles screen select Active Directory Domain Services.

  7. At the Add features that are required for Active Directory Domain Services? pop-up click Add Features.

  8. Now select Remote Desktop Services then click Next.

  9. At the Select features screen click Next.

  10. At the Active Directory Domain Services screen click Next.

  11. At the Remote Desktop Services screen click Next.

  12. At the Select role services screen select Remote Desktop Gateway.

  13. At the Add features that are required for Remote Desktop Services? pop-up click Add Features then click Next.

  14. At the Network Policy and Access Services screen click Next.

  15. At the Select role services screen click Next.

  16. At the Web Server Role (IIS) screen click Next.

  17. At the Select role services screen click Next.

  18. At the Confirm installation selections screen select Restart the destination server automatically if required.

  19. At the Add Roles and Features Wizard pop-up click Yes then click Install.

  20. When the installation completes click Close then Restart the VM.

 Configuring Active Directory Services (Formerly DCPROMO)

  1. When the Server Manager Dashboard opens click on AD DS in the Left-Pane.
  2. In the Right-Pane click on the Yellow Caution Sign then click Promote this server to a domain controller.
  3. At the Deployment Configuration screen under the Select the deployment operation section select Add a new forest.
  4. Under the Specify the domain information for this operation section enter HOME.LAB for the Root domain name then click Next.
  5. At the Domain Controller Options screen enter a password under the Type the Directory Services Restore Mode (DSRM) password section then click Next.
  6. At the DNS Options screen click Next.
  7. At the Additional Options screen click Next.
  8. At the Paths screen click Next.
  9. At the Review Options screen click Next.
  10. At the Prerequisites Check screen click Install

CONFIGURING NAME RESOLUTION FOR YOUR LAB

If you DO own your own Domain Name and DO HAVE a Static Public IP Address from your ISP, then you must assure that you have created an A Record for rdp.yourdomain.com with your Domain Name Registrar that points to your Static Public IP Address from your ISP.  Since the instructions for each vendor varies and Domain Record Creation is outside of the scope of this paper, please refer to each vendors instructions on how to register your own Domain Name.   Once this is confirmed you may move on to the CONFIGURING REMOTE DESKTOP GATEWAY CERTIFICATE section.

CONFIGURING REMOTE DESKTOP GATEWAY CERTIFICATE

Remote Desktop Gateway requires a certificate that matches the name that is used by the client machine.  Although there are workarounds that allow the use of a certificate issued by an internal Certificate Authority, the easiest method is using a Public Certificate Authority.

Acquiring a Public Certificate

Creating your Certificate Signing Request (CSR)

  1.  Log onto the VM.
  2. At the Start Menu click on Internet Information Services (IIS) Manager.
  3. In the Left-Pane (Connections) click on RDP-HOME-V (HOME\Administrator).
  4. At the pop-up message select Do not show this message and click No.
  5. In the Middle-Pane double-click Server Certificates.
  6. In the Right-Pane (Actions) click on Create Certificate Request.
  7. At the Distinguished Name Properties screen enter the following then click Next:

 

**Common Name: ** rdp.yourdomain.com (Should Be your Public Domain Name)

**Organization: ** Your made up Organization Name (Example Contoso)

**Organization Unit: ** Your made up Organization Unit (Example IT)

**City/locality: ** Your City

**State/province: ** Your State

Country/region:  Select Your Country

 

then click Next.

  1. At the Cryptographic Service Provider Properties screen change the Bit Length to ** 2048** then click Next.
  2. At the File Name screen under the Specify a file name for this certificate request section click the Ellipses button.
  3. Under File Name enter C:\yourdomain then click Open and then click Finish.

 

Submitting your Certificate Signing Request (CSR)

Once your CSR has been created then you must pick a Certificate Issuer such as DigiCert, GoDaddy, etc.  to submit your CSR to.  Since the instructions for each vendor varies and CSR submittal is outside of the scope of this paper, please refer to each vendors instructions on how to Submit your Certificate Request. 

Retrieving your Certificate

After submitting your CSR you should receive an email that your request is complete.  This email should contain a zipped attachment that includes your certificate or instructions on how to retrieve your certificate.  Save this attachment to your VM and extract it, then follow the steps below:

Importing your Certificate on your Remote Desktop Gateway

  1.  Log onto the VM.
  2. At the Start Menu click on Internet Information Services (IIS) Manager.
  3. In the Left-Pane (Connections) click on HOME-HOME-V (HOME\Administrator).
  4. In the Middle-Pane double-click Server Certificates.
  5. In the Right-Pane click on Complete Certificate Request.
  6. At the Specify Certificate Authority Response click the Ellipses button under the File name containing the certification authority’s response.
  7. At the pop-up box Navigate to the location where you extracted the zip file and select your certificate then click Open.
  8. Under the Friendly name section enter rdp.yourdomain.com then OK.
  9. Close the Internet Information Services (IIS) Manager.
  10. At the Start Menu click on Remote Desktop Gateway Manager.
  11. In the Left-Pane right-click **RDP-HOME-V (Local)**then select Properties.
  12. At the RDP-HOME-V Properties screen select the SSL Certificate tab.
  13. At the bottom of the windows click the Import Certificate button.
  14. At the Import Certificate pop-up select rdp.yourdomain.com then click the Import button.
  15. Click Apply then OK.

 

CONFIGURING REMOTE DESKTOP GATEWAY

Configuring Connection Authorization Policies (CAP) and Resource Authorization Policies (RAP)

  1. From the Left-Pane expand RDP-HOME-V (Local) then right-click Policies and select Create New Authorization Policies.

  2. At the Create Authorization Policies for RD Gateway screen click Next.

  3. At the Create an RD CAP screen enter HOME RD CAP then click Next.

  4. At the Select Requirements screen make sure Password is selected and also select Smartcard.

  5. Under the User Group membership (required): section click the Add Group button.

  6. At the Select Groups pop-up enter Domain Users then click Check Names.

  7. Once resolved (Underlined) click OK then click Next.

  8. At the Enable or Disable Device Redirection screen click Next.

  9. At the Set Session Timeouts screen click Next.

  10. At the RD CAP Settings Summary screen click Next.

  11. At the Create an RD RAP screen enter HOME RD RAP then click Next.

  12. At the Select User Groups screen confirm that HOME\Domain Users is added under the User group membership (required): section then click Next.

  13. At the Select Network Resources screen select Allow users to connect to any network resource (computer) then click Next.

  14. At the Select Allowed Ports screen click Next.

  15. At the RD RAP Settings Summary screen click Finish, then Close

Allowing Remote App Redirection

  1. Log onto the VM.

  2. Open an Elevated Command Prompt.

  3. Open the Registry by entering the following command:

    ** **

    regedit

     

  4. Navigate to the following:

     

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\Current Version\Terminal Server\TSAppAllowList

     

  5. In the Right-Pane double-click the FDisabledAllowList value.

  6. Under the Value data: section enter 1 then click OK.

CONFIGURING APPLICATION SOURCE

This machine should be a machine that is joined to your home lab environment and has the applications that you would like to stream to your secure location.

Granting Local Admin to Your Account

  1. From the Start Menu open Give administrative rights to a domain user.

  2. At the User Accounts pop-up click the Add button.

  3. At the Add a domain account screen under the User name: section enter your username and enter northamerica under the Domain: section then click Next.

  4. At the What level of access do you want to grant this user? Section select Administrator then click Next.

  5. At the You’re almost done screen click Finish, then OK.

 Publishing Home IE

  1. Log onto the VM.

  2. Open an Elevated Command Prompt.

  3. Open the Registry by entering the following command:

    ** **

    regedit

     

  4. Navigate to the following:

     

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\Current Version\Terminal Server

    ** **

  5. Right-Click TSAppAllowList and select New | Key and name it Applications.

  6. Right-Click Applications and select New | Key and name it IE.

  7. Right-Click IE Key and select New | String Value and name it Name.

  8. Double-Click Name value and enter IE.

  9. Right-Click IE Key and select New | String Value and name it Path.

  10. Double-Click Path value and enter C:\Program Files (x86)\Internet Explorer\iexplore.exe

** CONNECTING FROM YOUR CUSTOMER MACHINE**

Remote Desktop Connections can be saved with pre-populated settings in files called .rdp files.  In the following steps we will create a .rdp file that will be used to logon to your Home Desktop as well as launch a streamed IE session from your Home Laptop.

Creating a Corporate Desktop .rdp File

  1. Log on to your customer workstation.

  2. Open Remote Desktop Connection.

  3. Under the Computer: section enter your Corpnet Computer Name.

  4. Click on the Show Options button, then click on the Advanced tab.

  5. Under the Connect from anywhere section click on the Settings button.

  6. Server name: section enter rdp.yourdomain.com.

  7. Using the drop-down menu change the Logon method: from Allow me to select later to Smart card.

  8. Under the Logon settings section check the Use my RD Gateway credentials from the remote computer then click OK.

  9. Click on the General tab then under the Connection settings section click the Save As… button.

  10. Give the file a descriptive name then click Save.

 At the point you can Double-Click the previously created .rdp file to connect to your Home Desktop!!!

***Note:  At the Certificate Mismatch screen click Yes.

Creating a Home IE .rdp File

  1. Make a copy of the previously created .rdp clip then open it using Notepad.

  2. Change the following values:

     

    From                                                     To

    Gatewayusagemethod:i:2           Gatewayusagemethod:i:1

    Alternate shell:s:                              Alternate shell:s:rdpinit.exe

    Remoteapplicationmode:i:0        Remoteapplicationmode:i:1

     

  3. Add the following value:

     

    Remoteapplicationprogram:s:Iexplore 

TROUBLESHOOTING

Can’t connect to RemoteApp (IE) on Home Laptop

  1. Log on to your customer workstation.

  2. Launch the Desktop RDP clip.

  3. Once connected to  your Corpnet Laptop press Ctrl+Alt+End then click on Task Manager.

  4. At the bottom of the Task Manager windows click on More Details.

  5. Under Background Processes find RemoteApp Shell then Rick-Click it and select End Task.

  6. Repeat this process for RemoteApp Logon Application.

  7. Sign Out of the Remote Desktop session and try to re-connect using RemoteApp.