How to Configure RD Gateway CAP and RAP Policies
RD Gateway uses two authorization decisions. A Connection Authorization Policy (RD CAP) controls who may connect through the gateway. A Resource Authorization Policy (RD RAP) controls which internal resources those users may reach.
A successful connection must satisfy an applicable CAP and RAP. The destination computer then applies its own sign-in permissions. This guide uses a local CAP store and the standard RD Gateway policy manager.
Before You Begin
- A gateway with a working certificate, domain connectivity and administrator access.
- An AD security group for users, such as RDS-Gateway-Users, and a test account in that group.
- An AD security group containing the approved target computer accounts, such as RDS-Allowed-Computers.
- If your gateway already uses central NPS or an MFA authorization plug-in, manage policies through that design. Do not switch it to a local store just to follow this example.
-
Prepare separate user and computer groups
Create or identify the two security groups in Active Directory. Add permitted user accounts to the user group and target computer accounts to the computer group. Use recognizable names and document an owner for each.
For a collection, account for every approved target involved in the connection, including redirected Session Hosts. Avoid relying on a single test server when users can be sent to several hosts.
-
Open the authorization wizard
In RD Gateway Manager, expand your server. Review Properties → RD CAP Store to confirm this is a local-policy setup. Then right-click Policies and select Create New Authorization Policies. Choose the option to create both an RD CAP and an RD RAP.
If policies already exist, record their settings first. Adding a narrow policy does not remove access granted by another broader policy.
-
Define the connection policy
Give the CAP a descriptive name, such as CAP-Remote-Staff. In the requirements, select the supported authentication method and add RDS-Gateway-Users as an allowed user group. A password-based baseline uses the password option; it does not add MFA.
The optional client-computer group requirement refers to the connecting device, not the Session Host. Only use it when your design can validate those client computer identities. Destination computers belong in the RAP.
-
Choose redirection and timeout settings
Review device redirection controls and allow only what users need, such as printers or clipboard access. Select idle and session timeout behavior appropriate to the workload, then review the CAP summary.
Explain the chosen timeout behavior to your pilot users. A regular disconnection at a fixed interval can be a policy outcome rather than a network fault.
-
Restrict resources in the RAP
Name the RAP, for example RAP-Approved-Hosts, and select the allowed user group. Under network resources, choose the option for an Active Directory Domain Services network resource group and supply RDS-Allowed-Computers.
Alternatively, an RD Gateway-managed resource group can list explicitly approved computer names. Use the names clients and redirection actually request. Avoid the option that allows any network resource unless that broad access is an intentional requirement.
-
Restrict ports and complete the wizard
On the allowed ports page, permit the destination's RDP port, normally 3389. This is the internal target port, not the gateway's external HTTPS port. If the target uses a custom RDP port, configure that exact port.
Finish the wizard and verify both policies are enabled. Review all active CAPs and RAPs for overlapping access, and confirm the user has the required Remote Desktop permissions on the target.
-
Test both allowed and denied access
CAP and RAP verification matrix
Test Expected result Allowed user → approved target Connection succeeds if the target also authorizes the user. User outside allowed groups → approved target Gateway access is denied. Allowed user → unapproved target Resource access is denied. Allowed user → unapproved target port Resource access is denied.
Use fresh sessions after group changes. Review the gateway and NPS events when results differ, including other policies that may authorize the request.
Frequently Asked Questions
No. Gateway policies and the target's local or domain logon permissions are separate checks.
Admin Note: Use a small pilot group and explicit destinations. Record the denied-access tests as well as the successful login before expanding access.
Adding More RDS Users?
Access groups control authorization. Review the RDS CAL requirements separately when adding users or devices to an RD Session Host deployment.
Author Bio
Microsoft Certified Professional
With over 20 years of experience deploying and managing enterprise Windows Server environments, Keloth leads technical implementation at RDS CAL Store. He specializes in Remote Desktop Services infrastructure, secure remote architecture, and helping IT teams seamlessly scale their official licensing.
Related Posts
Understanding RDS CAL Downgrade Rights
Home – Understanding RDS CAL Downgrade Rights Understanding RDS CAL Downgrade Rights When managing a Remote Desktop Services environment, hardware and software upgrades rarely happen all at once. You might purchase new Client Access Licenses (CALs) today, but still need them to authorize connections to older servers running in your datacenter. Microsoft accommodates this reality…
How to Disable Remote Desktop Easy Print in Windows Server (2016-2025)
Home – How to Disable Remote Desktop Easy Print in Windows Server (2016-2025) How to Disable Remote Desktop Easy Print in Windows Server (2016-2025) Remote Desktop Easy Print is the default driver Windows uses to map local client printers into a remote session. While convenient, it strips away advanced printer features (like stapling, tray selection,…
How to Create a Remote Desktop User in Windows Server (2016, 2019, 2022 & 2025)
Home – How to Create a Remote Desktop User in Windows Server (2016, 2019, 2022 & 2025) How to Create a Remote Desktop User in Windows Server (2016, 2019, 2022 & 2025) Provisioning remote access for a new employee requires more than just creating a standard Windows account. To securely connect to a Session Host,…
How to Fix the CredSSP “Encryption Oracle Remediation” RDP Error
Home – How to Fix the CredSSP “Encryption Oracle Remediation” RDP Error How to Fix the CredSSP “Encryption Oracle Remediation” RDP Error If you are managing Windows Servers, you have likely encountered this terrifying error message when trying to connect via Remote Desktop: “An authentication error has occurred. The function requested is not supported… This…