Duo RD Gateway CAP/RAP Session timeout settings

[GaryDoven]

Duo is installed and working well on our RD Gateway server. RD Gateway Manager shows

“Due to pluggable authorization, Remote connection authorization policies and Remote Desktop resource authorization policies are no longer used to manage authentication and authorization on this system. Use the appropriate administrative tool to manage these services.”

That is fine and we knew that would be the case from the installation doc.
There is no Duo admin tool for managing this.
My problem now is that since installing and rolling out Duo to users, everyone now has an 8 hour active session limit enforced. That is, the user is actively working and using the computer at the 8 hour mark after they logged in and they are booted out.

How can I lift this limit? Is there an admin section in Duo that I am not aware of?
Cheers

[DuoKristina]

Hi @thecalstanley,

Take a look at our @PatrickKnight 's last post to this thread.

[arob]

Has this been added to any release schedule? I ask because a client of mine is considering dumping Duo if they can’t get a timeline on this. They have a global consultancy that relies heavily on RDS and having them kicked out at 8 hours is an untenable situation. Installing Duo on session hosts is not an option.

[Ronnie1]

Ok so we also discovered this after implementing Duo in our environment.

I would like the option to turn this completely off, RD has it’s own timeout settings that can be controlled via policy.

[#5]

Adding wait to argument - we have been evaluating products for our business, this NON feature is a show stopper.

[misternik]

All,
Duo user and MSP. Our customer asks for new timeout values and copy/paste.
Customer is very impressed with DUO. But now I need to tell them that they cannot change something as simple as the timeout values.
What shall I tell the customer?

[dark1077]

I work for an MSP and we just came across this issue with a new client.

This issue has caused a lot of frustration for users as well as us, we spent weeks trying to find the cause only to eventually find out that Duo RDGW takes over the CAP/RAP policies and hard sets the timeout, and the only mention of this in the documentation on the site is a footnote under Testing!, this is something which SHOULD be hightlighted in the documentation at the top Before even reading anything else about the RDGW implementation.

The fact that this is still an issue 18 months after the last Duo RD Gateway update was released is rediculous.
The date on the RDGW installer is from April 2018, and we’re still being told by support that the only workaround is to remove it and install it on the RDS hosts.

We also asked about the inability for this “Recommended Solution” to support the “Authorized Networks” functionality and were basically told that they cannot advise on that as they dont know our network. What’s there to know, you’re talking about removing the app from RDGW and installing the RDS one, this isn’t complicated.
Very disappointing considering you guys developed these various implementations but can’t advise on how they actually work!

Needless to say I will NOT be recommending Duo to any future clients.

[Ronnie1]

Some kind of situation report would be nice, I was added to a feature request a couple of months ago but haven’t heard anything from that. Is there anyway to get this prioritised? It’s a major nuisance.

[solae1]

Is there any update to this Issue? We and our customer have the same Problem with the 8 hour Timeout.

Maybe, if it’s not configurable, it could be set to 14 hours or something by Duo? This would normaly be enough for a Workday.

[Amy2]

Hi solae,

We don’t have an update at this time, other than what has been shared on this thread earlier. The issue has been documented, and our team will continue to work to address this feature for the future. We don’t have any timelines or ETAs currently.

Your account executive or customer success manager (CSM), if applicable, may be able to shed some more insight into this than we can provide publicly in the community. I encourage you to speak with them.

[NotKnown]

Still kinda sad that after 2 years! there is still no solution to fix an simple timeout change.
Youre the only one that has an nice MFA for RD Gateway. We still cant use this now.

[Amy2]

Hi @NotKnown

Thank you for sharing your interest on this feature, and for your kind words about our solution for RD Gateway! We know how important this request is to all of you. Please rest assured that the moment we have an update to share here, we will do so.

As @PatrickKnight previously stated, we cannot share the registry setting as this is an unsupported configuration and may result in unexpected behavior. We also ask that you do not do so. (Please note: Any posts including these will be deleted by the mods here).

Anyone who is interested can be added to the feature request by contacting Duo support, your account executive (AE), or your customer success manager (CSM) if you are a Duo Care customer with a dedicated CSM.

If you’re already on the request, and you don’t want to wait for an update from us here, you are welcome to enquire as to the status of this request with your AE or CSM at any time. They usually can share more details than we can in a public forum

I hope that helps!

[eg-je]

Workaround supported or not, if it works = it works. If Engineers deliberately break the workaround then Duo becomes unsuitable as an MFA product for this use case. As it might as well be considered given the existing session limit.

Unfortunately, the lack of progress is sorely disappointing. As is the insistence to recommend installing Duo directly on Session Hosts. Has anyone at Duo ever tried this? It’s frustrating as anything for an end user to constantly have to re-MFA when their session locks.

This needs to be resolved and quickly, else I’m going to seriously begin to reconsider my position on Duo within our organisation. With a bit of time and effort, I can integrate a competitors product (which we get for free) across our systems and cease 250 Duo licenses in the process, saving $$$.

… it shouldn’t matter whether it’s 250 licenses at risk, 25,000 or 25. It’s time for Duo to deliver.

[PatrickKnight · Accepted solution]

In light of COVID-19 and the exponential rise we’ve seen in RDGateway usage, we have updated our Knowledge Base article to include the necessary keys to edit the Max Sessions and Idle Timeout values. These options are still unsupported, but have been tested against Microsoft Server 2012R2 through Server 2019, so please utilize them at your own risk.

We know this has been a long-requested option that has gone unaddressed, and we hope offering these keys as an unsupported option will help improve your experience with Duo, but publishing these keys still does not live up to the expectation we’d like to offer around RDG. Hopefully this helps today and we’ll update the community with additional information we have to share around the future of RDG.

If you have any feedback please DM me here or reach out to me via email at pknight@duo.com

Thanks,
Patrick

[GaryDoven]

Thank you Patrick,

This has been a long running request. I am so happy that the unsupported work-around information is now being supplied publicly so that the end user can weigh up their options themselves. We can perform our own risk assessment and make a decision whether to implement an unsupported (although working) solution to resolve this issue.

I hope that the realization of how necessary it is for Duo’s RDGateway solution to have options to change these values means that development of a supported solution gains some traction by Duo’s dev team.

Stay safe,
Gary