RD Gateway not working after upgrading RD Web to v3.0.0

[robnicholsonmalt]

As usual, I'm very confused by the information about Duo for Remote Desktop Services. I've got four clients running the RD Web and RD Gateway combination on Windows Server 2019. They've also received the email that traditional authentication is EOL at the end of the month and to upgrade to Universal authentication.

I've just upgraded RD Web v3 on my test server and after doing this, I can no longer connect using RDP. RD Web is working fine - I've enabled universal prompt there during logon. But launch the RDP and you get the eror below. This article is talking about it but I'm afraid the section "How does Duo Authentication for RD Web affect RemoteApp and Desktop Connections?" is very confusing.

Anyone able to explain it in more simple terms? Can Duo not be used anymore for RDS/RDP or is there some other new system called "Duo authentication for RD Gateway"?

FAQ - Two-Factor Authentication for Microsoft Remote Desktop Services | Duo Security

[DuoKristina]

It's not expected that a regular RDP connection would be interrupted or modified by Duo Authentication for RD Web. The mentions of Duo for RD Web interrupting "RemoteApp and Desktop Connections" is referring specifically to when you try to add the webfeed url for RD Web to the RemoteApp config on a client. Once you install Duo for RD Web the webfeed.aspx url requires interactive browser authentication, which RemoteApp can't do and therefore apps aren't available that way anymore.

Is the RDP (mstsc.exe) connection that now fails direct to 3389 on the RD Web server, or is it getting tunneled through an RD Gateway server, and if via RDG they also have Duo for RD Gateway installed?

You might want to contact Duo Support so they can advise the various places you can turn on debug logging and sort through the output if you haven't been able to do that yourself (instructions for enabling debug are on the page you linked as well as in the Duo KB at https://help.duo.com).