Create a TCP target for an RDP host

You can configure a TCP target to authorize a session between the client and end host. Users can connect to remote hosts using RDP, and you can attach brokered credentials to the TCP target to simplify the connection process. Unlike RDP target types, TCP targets cannot use credential injection. Boundary passes any brokered credentials directly back to the client session.

Note

You cannot configure TCP targets to use session recording or credential injection.

You can configure any networked service available with an address and port as a TCP target. Boundary must have access to the target to start a session. If your service is not publicly available, you will need to deploy a worker to give Boundary access to the target network.

The following examples use a direct target address for simplicity, but HashiCorp recommends that you configure host catalogs and host sets for scaled production deployments.

Complete the following steps to create a TCP target for an RDP host.

Log in to Boundary.
Select an org, and then select the project where you want to create a target.
Select Targets under Project Actions.
Click New Target.
Complete the following fields:
- Name: (Required) A name for identification purposes. The name must be unique.
- Description: (Optional) An optional description of the target for identification purposes.
- Type: (Required) Select TCP to create a TCP target.
- Target Address (Optional) If you are not using host catalogs and host sets, you can enter a target address instead to map the target to a single address. This must be a valid IP address or DNS name.
- Default Port (Required) The default port on which to connect, such as 3389.
- Aliases (Optional) A globally-scoped unique identifier for the target, which makes the target easier to connect to using the CLI or transparent sessions. If you create an alias, click Add to assign it.
Click Save.

Log in to Boundary.
Set the BOUNDARY_PROJECT_ID environment variable, or provide the scope ID (such as p_1234567890) in the next step.
Use the following command to create a TCP target named windows-server-2025 with an alias windows.2025, with a direct target address of 10.0.0.20 and a default connection port of 3389:
```
$ boundary targets create tcp \
  -scope-id $BOUNDARY_PROJECT_ID \
  -name "windows-server-2025" \
  -with-alias-value "windows.2025" \
  -address "10.0.0.20" \
  -default-port 3389
```
You must provide the scope-id field when you create a target.
Refer to the targets domain model documentation for more fields that you can use when you create targets, and the targets create command for all the CLI options.

You can define a target and target alias using the Boundary Terraform provider:

resource "boundary_target" "windows_rdp" {
  name         = "windows-server-2025"
  description  = "TCP target for RDP host"
  type         = "tcp"
  address      = "10.0.0.20"
  default_port = "3389"
  scope_id     = boundary_scope.project.id
  injected_application_credential_source_ids = [
    boundary_credential_username_password.windows_rdp_creds.id
  ]
}

resource "boundary_alias_target" "windows_target_alias" {
  name                      = "windows-server-2025-alias"
  description               = "Target alias for windows-server-2025"
  scope_id                  = "global"
  value                     = "windows.2025"
  destination_id            = boundary_target.windows_rdp.id
}

Configure a brokered application credential

You can configure a brokered application credential for end users to connect to the target. Brokered credentials are exposed to the end user to allow them to authenticate to a target manually, or using connect helpers.

Note

You can configure TCP targets with credential brokering, but not credential injection.

You can configure credentials for the TCP target using:

Static credentials (username_password_domain)
Vault generic credential library
Vault LDAP credential library

Refer to the Configure targets with credential brokering page to learn how to configure a target with credential brokering.

Next steps

To learn how to connect to a target, refer to Connection workflows.

To use target aliases to connect to targets:

Create a target alias
Connect to a target using an alias
After you set up a target alias, you can optionally Configure transparent sessions for end users. ^HCP/ENT