Skip to main content

RDP Access Without Password with Guacamole

The Context​

Marc is the operations manager at LogiNord, a logistics company that manages several Active Directory domains: one per site and one per environment (production, testing). His technicians open remote desktop sessions on about ten Windows servers every day. Each juggles multiple accounts and several passwords, copied from a password manager, and sometimes shared via messaging when there is urgency.

The Problem Without VaultysHub​

  • One account and one password per domain and per server that each technician must know
  • Passwords copied-pasted, noted, or shared, thus impossible to keep secret
  • An RDP client to install and configure on each workstation
  • No centralized record of who opened which session, nor what happened in it
  • When a technician leaves, all the passwords they knew must be changed

With VaultysHub and Guacamole​

Step 1 — Deploy Guacamole Near the Servers​

Marc installs Apache Guacamole with Docker on a machine that can reach the Windows servers. Guacamole opens RDP sessions on behalf of the technicians and displays them in the browser: no client to install anymore.

Step 2 — Connect Guacamole to VaultysHub​

Marc creates an OpenID Connect application "Remote Desktop" in VaultysHub and assigns it to the technician group. Guacamole no longer manages its own passwords: to access it, one must authenticate with their VaultysID.

Step 3 — Declare the Servers Only Once​

In Guacamole, Marc declares each server with the Windows account to use and its password, organized by domain. He then checks, for each technician, the servers they are authorized to access. The passwords remain in Guacamole: the technicians never see them.

Step 4 — On a Daily Basis​

A technician opens the "Remote Desktop" link from their VaultysHub dashboard, validates with their VaultysID, and selects a server from the list. The Windows desktop opens in a tab, without any password entry. To switch servers or domains, they return to the list.

Step 5 — Trace and Revoke​

Marc activates session recording on sensitive servers. When a technician leaves the company, it is enough to remove their application in VaultysHub: they did not know any passwords, so nothing needs to be changed.

What It Changes​

Without VaultysHubWith VaultysHub + Guacamole
One password per domain to remember or copyA single authentication with the VaultysID
Known, copied, and shared passwordsPasswords stored server-side, never displayed
RDP client to install on each workstationSession in the browser
No centralized recordLogins recorded in VaultysHub, sessions recorded in Guacamole
Departure = change of all passwordsDeparture = removal of the application in VaultysHub

Features Used​