Notifications
Clear all
Topic starter
21/08/2026 4:43 pm
TL;DR: Replacing Microsoft RD Gateway with a brokered RDP architecture can reduce internet exposure, improve performance, and make access evidence easier to audit by moving authorization, MFA, and session control into a central policy plane, according to Devolutions. The governance shift matters because RDP security is no longer just about network entry, it is about who can reach which host, for how long, and with what proof.
NHIMG editorial — based on content published by Devolutions: Replacing Microsoft RD Gateway for secure, faster and auditable RDP
Questions worth separating out
A: Treat the session as the control unit.
Q: Why does RD Gateway create governance risk even when it hides RDP from the internet?
A: Because hiding the port is not the same as constraining entitlement.
Q: What breaks when remote administration lacks per-session evidence?
A: Investigations become slow and uncertain because teams cannot reconstruct who approved the session, which host was reached, or whether credentials were injected.
Practitioner guidance
- Move authorization into a control plane Centralize approval, MFA, and time-boxed access decisions so the RDP session opens only after policy evaluation has succeeded.
- Require per-session evidence for privileged RDP Record requester, host, start and stop times, approval reference, and credential-injection status for every administrative session.
- Eliminate exposed gateway dependency paths Reduce direct internet exposure and avoid designs that rely on broad gateway reachability for remote administration.
What's in the full article
Devolutions' full white paper covers the operational detail this post intentionally leaves for the source:
- Step-by-step deployment guidance for Devolutions Gateway, Devolutions Server, and Remote Desktop Manager in a live environment
- Configuration detail for MFA enforcement, JIT approvals, and credential injection across RDP workflows
- Per-session logging and optional recording options for audit and investigation workflows
- Implementation notes for SMBs, MSPs, and regulated environments that need faster access without broad exposure
👉 Read Devolutions' white paper on replacing Microsoft RD Gateway for auditable RDP →
RD Gateway replacement for RDP: what changes for IAM teams?
Explore further
21/08/2026 5:03 pm
RD Gateway replacement is really a governance redesign, not a transport swap. The core issue is that access architecture should not stop at secure entry, because privileged remote work needs entitlement, time bounds, and evidence as first-class controls. Once organisations understand that, the discussion shifts away from tunnel performance and toward who can create, approve, and prove a session. The practitioner conclusion is simple: remote access must be governed as an identity transaction.
A few things that frame the scale:
- The average organisation believes more than 1 in 5 of their non-human identities are insufficiently secured, according to The 2024 ESG Report: Managing Non-Human Identities.
- Two-thirds of enterprises have endured a successful cyberattack resulting from compromised non-human identities, which is why privileged access governance now has to assume identity abuse is a normal operating condition.
A question worth separating out:
A: Accountability becomes fragmented across infrastructure, IAM, and operations teams, which usually means gaps go unresolved. A coherent privileged access model needs one policy owner for approval, one evidence trail for the session, and one process for reviewing exceptions.
👉 Read our full editorial: Replacing RD Gateway changes RDP governance, not just access
