RDP targets

Enterprise

This feature requires HCP Boundary or Boundary Enterprise.

RDP targets use injected application credentials to authenticate an RDP session between the client and end host in Windows environments that use Active Directory authentication. Injected credentials allow users to securely connect to remote hosts using RDP, while never being in the possession of a valid credential for that target host.

To set up an RDP target, you must:

Use HCP Boundary or Boundary Enterprise
Configure an RDP target type
Configure credential injection for the RDP target

You can configure any networked service available with an address and port as a TCP target. Boundary must have access to the target to start a session. If your service is not publicly available, you will need to deploy a worker to give Boundary access to the target network.

Create an RDP target

The following examples use a direct target address for simplicity, but HashiCorp recommends that you configure host catalogs and host sets for scaled production deployments.

Complete the following steps to create an RDP target.

Log in to Boundary.
Select an org, and then select the project where you want to create a target.
Select Targets under Project Actions.
Click New Target.
Complete the following fields:
- Name: (Required) A name for identification purposes. The name must be unique.
- Description: (Optional) An optional description of the target for identification purposes.
- Type: (Required) Select RDP to create an RDP target.
- Target Address (Optional) If you are not using host catalogs and host sets, you can enter a target address instead to map the target to a single address. This must be a valid IP address or DNS name.
- Default Port (Required) The default port on which to connect, such as 3389.
- Aliases (Optional) A globally-scoped unique identifier for the target, which makes the target easier to connect to using the CLI or transparent sessions. If you create an alias, click Add to assign it.
Click Save.

Log in to Boundary.
Set the BOUNDARY_PROJECT_ID environment variable, or provide the scope ID (such as p_1234567890) in the next step.
Use the following command to create an RDP target named windows-server-2025 with an alias windows.2025, with a direct target address of 10.0.0.20 and a default connection port of 3389:
```
$ boundary targets create rdp \
  -scope-id $BOUNDARY_PROJECT_ID \
  -name "windows-server-2025" \
  -with-alias-value "windows.2025" \
  -address "10.0.0.20" \
  -default-port 3389
```
You must provide the scope-id field when you create a target.
Refer to the targets domain model documentation for more fields that you can use when you create targets, and the targets create command for all the CLI options.

You can define a target and target alias using the Boundary Terraform provider:

resource "boundary_target" "windows_rdp" {
  name         = "windows-server-2025"
  description  = "RDP target"
  type         = "rdp"
  address      = "10.0.0.20"
  default_port = "3389"
  scope_id     = boundary_scope.project.id
  injected_application_credential_source_ids = [
    boundary_credential_username_password.windows_rdp_creds.id
  ]
}

resource "boundary_alias_target" "windows_target_alias" {
  name                      = "windows-server-2025-alias"
  description               = "Target alias for windows-server-2025"
  scope_id                  = "global"
  value                     = "windows.2025"
  destination_id            = boundary_target.windows_rdp.id
}

Configure an injected application credential

You must configure an RDP target with an injected application credential for end users to connect to the target.

You can configure credentials for the RDP target using:

Static credentials (username_password_domain)
Vault generic credential library
Vault LDAP credential library

Refer to the Configure targets with credential injection page to learn how to configure a target with credential injection.

Next steps

To learn how to connect to a target, refer to Connection workflows.

To use target aliases to connect to targets:

Create a target alias
Connect to a target using an alias
After you set up a target alias, you can optionally Configure transparent sessions for end users. ^HCP/ENT