Oct 31, 2018 Verify that the Remote Desktop endpoint for the Azure VM is also using TCP port 3398 as its internal port. Restart the Azure VM and try the Remote Desktop connection again. Additional resources. How to reset a password or the Remote Desktop service for Windows virtual machines. How to install and configure Azure PowerShell. Connect to the RDS deployment as an administrator and change the RD Gateway server name for the deployment. This configuration ensures that connections go through the Azure AD Application Proxy service. Connect to the RDS server running the RD Connection Broker role. Launch Server Manager. Select Remote Desktop Services from the pane on the left.

-->

Linux virtual machines (VMs) in Azure are usually managed from the command line using a secure shell (SSH) connection. When new to Linux, or for quick troubleshooting scenarios, the use of remote desktop may be easier. This article details how to install and configure a desktop environment (xfce) and remote desktop (xrdp) for your Linux VM running Ubuntu.

The article was writen and tested using an Ubuntu 18.04 VM.

Remote desktop connection azure download

Prerequisites

This article requires an existing Ubuntu 18.04 LTS VM in Azure. If you need to create a VM, use one of the following methods:

The Azure CLI
The Azure portal

Install a desktop environment on your Linux VM

Most Linux VMs in Azure do not have a desktop environment installed by default. Linux VMs are commonly managed using SSH connections rather than a desktop environment. There are various desktop environments in Linux that you can choose. Depending on your choice of desktop environment, it may consume one to 2 GB of disk space, and take 5 to 10 minutes to install and configure all the required packages.

The following example installs the lightweight xfce4 desktop environment on an Ubuntu 18.04 LTS VM. Commands for other distributions vary slightly (use yum to install on Red Hat Enterprise Linux and configure appropriate selinux rules, or use zypper to install on SUSE, for example).

First, SSH to your VM. The following example connects to the VM named myvm.westus.cloudapp.azure.com with the username of azureuser. Use your own values:

If you are using Windows and need more information on using SSH, see How to use SSH keys with Windows.

Next, install xfce using apt as follows:

Remote Desktop Connection Azure Cloud Service

Install and configure a remote desktop server

Now that you have a desktop environment installed, configure a remote desktop service to listen for incoming connections. xrdp is an open source Remote Desktop Protocol (RDP) server that is available on most Linux distributions, and works well with xfce. Install xrdp on your Ubuntu VM as follows:

Tell xrdp what desktop environment to use when you start your session. Configure xrdp to use xfce as your desktop environment as follows:

Restart the xrdp service for the changes to take effect as follows:

Set a local user account password

If you created a password for your user account when you created your VM, skip this step. If you only use SSH key authentication and do not have a local account password set, specify a password before you use xrdp to log in to your VM. xrdp cannot accept SSH keys for authentication. The following example specifies a password for the user account azureuser:

Note

Specifying a password does not update your SSHD configuration to permit password logins if it currently does not. From a security perspective, you may wish to connect to your VM with an SSH tunnel using key-based authentication and then connect to xrdp. If so, skip the following step on creating a network security group rule to allow remote desktop traffic.

Create a Network Security Group rule for Remote Desktop traffic

To allow Remote Desktop traffic to reach your Linux VM, a network security group rule needs to be created that allows TCP on port 3389 to reach your VM. For more information about network security group rules, see What is a network security group? You can also use the Azure portal to create a network security group rule.

The following example creates a network security group rule with az vm open-port on port 3389. From the Azure CLI, not the SSH session to your VM, open the following network security group rule:

Connect your Linux VM with a Remote Desktop client

Open your local remote desktop client and connect to the IP address or DNS name of your Linux VM.

Enter the username and password for the user account on your VM as follows:

After authenticating, the xfce desktop environment will load and look similar to the following example:

If your local RDP client uses network level authentication (NLA), you may need to disable that connection setting. XRDP does not currently support NLA. You can also look at alternative RDP solutions that do support NLA, such as FreeRDP.

Troubleshoot

If you cannot connect to your Linux VM using a Remote Desktop client, use netstat on your Linux VM to verify that your VM is listening for RDP connections as follows:

The following example shows the VM listening on TCP port 3389 as expected:

If the xrdp-sesman service is not listening, on an Ubuntu VM restart the service as follows:

Review logs in /var/log on your Ubuntu VM for indications as to why the service may not be responding. You can also monitor the syslog during a remote desktop connection attempt to view any errors:

Other Linux distributions such as Red Hat Enterprise Linux and SUSE may have different ways to restart services and alternate log file locations to review.

If you do not receive any response in your remote desktop client and do not see any events in the system log, this behavior indicates that remote desktop traffic cannot reach the VM. Review your network security group rules to ensure that you have a rule to permit TCP on port 3389. For more information, see Troubleshoot application connectivity issues.

Next steps

For more information about creating and using SSH keys with Linux VMs, see Create SSH keys for Linux VMs in Azure.

For information on using SSH from Windows, see How to use SSH keys with Windows.

Introduction

Windows 10 introduces the ability to join a computer to the cloud directory service Azure AD. This is very similar to the traditional domain join, where you join a computer to an Active Directory domain, run on-premises by one or more Domain Controllers. Both operations lets the computer operate within a common security context and benefit from Single Sign-On (SSO) to all resources that share the same security context. However, joining Azure AD instead of a traditional domain can break things or make them more difficult. There are many examples of this, but the one I want to discuss here is connecting with Remote Desktop (RDP) to an Azure AD joined computer with a user account from Azure AD. Just to be clear; the connection we want to establish is to an Azure AD joined computer, logging on with an account from Azure AD. This account can either be synced from on-premises or be mastered in the cloud, and both federated and password logons are supported. We do not depend on any local accounts on the computer, using tricks such as adding an Azure AD work account to a local account or a Microsoft Account (MSA), this is pure Azure AD.

Connecting Successfully

There are some obvious prerequisites for this to work:

The computer must be joined to Azure AD
Remote Desktop connections must be enabled and allowed through the host firewall
Any other firewall between you and the computer must allow the Remote Desktop protocol

The key to connecting is having Windows 10 present an desktop login screen:

That means that we must disable any form of single sign-on or integrated authentication. This requires the following steps:

On the Windows 10 computer; disable Network Level Authentication (N