RDP and Windows

Airlock provides secure passwordless access to Microsoft Windows desktops for local Windows users (not an Active Directory domain).

Prerequisites

• A Linux server for the Windows Desktop Service (the service can be added to an existing Airlock instance using a new join token).
• A physical or virtual Windows machine with Remote Desktop enabled; the RDP port (usually 3389) open to the Linux server running the agent.
• airctl on the administrative machine with cluster access.

Step 1 of 4. Prepare Windows

On the Windows computer in the command prompt (cmd.exe):

1. Export the Airlock user certificate CA:

curl.exe -fo airlock.cer https://airlock.example.com/webapi/auth/export?type=windows

1. Download the Airlock Windows Auth installer (substitute the current version):

curl.exe -fo airlock-windows-auth-setup-amd64.exe https://deckhouse.ru/downloads/airlock/airlock-windows-auth-setup-amd64.exe

1. Run the installer and select the exported certificate airlock.cer. The installer:

   • trusts the Airlock CA;
   • installs the integration DLL;
   • disables NLA for RDP;
   • enables RemoteFX if needed.

2. Reboot the computer.

Automated installation from an elevated cmd/PowerShell:

airlock-windows-auth-setup-amd64.exe install --cert=airlock.cer -r

Step 2 of 4. Windows Desktop Service

1. Generate a join token:

airctl tokens add --type=windowsdesktop

1. Save the token to a file on the Linux server, for example /tmp/token.

2. Verify that Airlock is installed:

airlock version

If needed:

curl https://deckhouse.ru/downloads/airlock/install.sh | bash -s

1. Configure /etc/airlock.yaml:

version: v3
airlock:
  nodename: windows-agent.example.com
  proxy_server: airlock.example.com:443
  auth_token: /tmp/token
windows_desktop_service:
  enabled: yes
  static_hosts:
  - name: win-desktop-1
    ad: false
    addr: 192.0.2.155
    labels:
      datacenter: dc1
auth_service:
  enabled: no
proxy_service:
  enabled: no
ssh_service:
  enabled: no

• proxy_server — address of the cluster Proxy Service.
• static_hosts / non_ad_hosts — IPs or hostnames of Windows machines (autodiscovery is unavailable without AD).

1. Start the service:

sudo systemctl enable airlock
sudo systemctl start airlock
sudo systemctl status airlock

Step 3 of 4. Role for desktop access

Create windows-desktop-admins.yaml:

kind: role
version: v6
metadata:
  name: windows-desktop-admins
spec:
  allow:
    windows_desktop_labels:
      "*": "*"
    windows_desktop_logins: ["Administrator", "alice"]

airctl create -f windows-desktop-admins.yaml

Assign the role to the user via airctl users update.

Step 4 of 4. Connect

1. Log in to the Airlock web interface with an account that has the windows-desktop-admins role.

2. Go to Resources → filter by Desktops → click Connect next to the desired desktop → select the Windows login.

3. The RDP session opens in the browser and is recorded. Use Disconnect to end the session.

4. Recordings are available under Management → Session Recordings.

Next steps

• Narrow access using windows_desktop_labels and separate roles for different user groups.
• For multiple desktops, use labels in static_hosts and label-based RBAC.