An RDP RemoteApp connection is performed by protocol channels.
The connection is established and a channel is opened directly on the desired binary. If the binary requires authentication, it can be done through binary arguments or by the automation macro.
The operator user will be isolated from the RemoteApp binary in the RDP session. If the user minimizes the application window, other applications cannot be used. Additionally, if the user closes the RemoteApp binary, the session will be terminated.
For RemoteApp, the audited command feature won’t be available.
To configure RemoteApp you need to configure the macro, access the How to configure a RemoteApp document to perform this action.
In the report, you can access all macros and RemoteApps registered on Segura®. Note that the configuration is populated with the location of the binary and, as arguments, the masks will be applied to username, password, hostname, and additional information.
Finally, configure a credential with the RemoteApp macro to use and, if necessary, provide the device access credential.
When you log in using Segura® RDP Proxy, if the credential has a RemoteApp configured, the available options for access will be displayed to the user, but, if the credential is configured to restrict access only to the remote application, then the option to access the system won’t be displayed.
In Windows environments, it’s important to create stricter security policies. To better understand and download the complete guide, access the About security settings for RDP Proxy and RemoteApp document.
Publishing through a Connection Broker
Some Windows environments do not expose remote applications on a single host. Instead, a Remote Desktop Connection Broker receives the connection and routes it to one of the hosts of a session collection. This is what makes load balancing possible.
By default, an RDP RemoteApp connection sends the application and its arguments together, in a single command, to the host that answers the connection. A Remote Desktop Connection Broker needs to receive, as separate values, the application, its arguments, and the information that identifies the target collection.
The Connection Broker field of the RemoteApp registration switches between the two behaviors:
- Disabled: the connection keeps the single-command form. This is the default, and it is why registrations created before this field existed continue to work without any change.
- Enabled: the application and its arguments travel as separate values. The connection also carries the value from Load balance info, an optional working directory, and any custom settings from Advanced options.
Enabling the field changes only how the RDP Proxy assembles the connection. It does not change session isolation or credential behavior, and the limitation on the audited command feature still applies.
More information in How to register a RemoteApp.