RDP targets

1. Log in to Boundary.
2. Select an org, and then select the project where you want to create a target.
3. Select Targets under Project Actions.
4. Click New Target.
5. Complete the following fields:
   • Name: (Required) A name for identification purposes. The name must be unique.
   • Description: (Optional) An optional description of the target for identification purposes.
   • Type: (Required) Select RDP to create an RDP target.
   • Target Address (Optional) If you are not using host catalogs and host sets, you can enter a target address instead to map the target to a single address. This must be a valid IP address or DNS name.
   • Default Port (Required) The default port on which to connect, such as 3389.
   • Aliases (Optional) A unique identifier for the target, which makes the target easier to connect to using the CLI or transparent sessions. To create an alias, complete the following fields, and then click Add:
     • Select scope: Select the scope in which to create the alias. You must create org and project suffixes before you can create an alias in the target's project scope. Otherwise, you can only create the alias in the global scope. Refer to Create a suffix for a scope for more information.
     • Alias value: Enter the string that you want to use as the alias to represent the target. An alias's value can be a hostname or a DNS-like string.
6. Click Save.

1. Log in to Boundary.

2. Set the BOUNDARY_PROJECT_ID environment variable, or provide the scope ID (such as p_1234567890) in the next step.

3. Use the following command to create an RDP target named windows-server-2025 with an alias windows.2025, with a direct target address of 10.0.0.20 and a default connection port of 3389:

   $ boundary targets create rdp \
     -scope-id $BOUNDARY_PROJECT_ID \
     -name "windows-server-2025" \
     -with-alias-value "windows.2025" \
     -address "10.0.0.20" \
     -default-port 3389
   

   You must provide the scope-id field when you create a target.

   You can use any of the following attributes when you create an RDP target:

   • -description=<string> - Specifies the optional description of the target that you want to use for identification purposes.

   • -name=<string> - Specifies the optional name you want to use to describe the target for identification purposes.

   • -scope-id=<string> - Scope in which to create the target. The default is global. You can also specify the scope using the BOUNDARY_SCOPE_ID environment variable.

   • -address=<string> - An optional valid network address for the target to connect to. You cannot use an address alongside host sources.

     If you set a target address for RDP targets that use Kerberos authentication, use the target's hostname and append the domain to it, for example target-hostname.mydomain.com. For RDP targets that use NTLM authentication, set the target address to the target's IP address.

   • -default-client-port=<string> - The default client port on the target.

   • -default-port=<string> - The default port on the target. For Client Agent versions prior to 0.21.2, you must configure a custom port to use transparent sessions with RDP targets.

     Refer to RDP targets for more information about configuring a custom port for transparent sessions.

   • -egress-worker-filter=<string> - A Boolean expression that filters which egress workers can process sessions for the target.

   • -ingress-worker-filter=<string> - A Boolean expression that filters which ingress workers can process sessions for the target.

   • -session-connection-limit=<string> - The maximum number of connections allowed for a session. A value of -1 means the connections are unlimited.

     The Windows Remote Desktop Connection application consumes multiple connections when initiating a session. If you set the session-connection-limit to 1 for RDP targets it will cause all RDP connections using this client to fail. You can leave the connection limit unset or configure a limit of 2 or higher to account for the multiple connections used by the RDP client.

     Refer to RDP target attributes for more information.

   • -session-max-seconds=<string> - The maximum lifetime of the session, including all connections. You can specify an integer number of seconds or a duration string. If you do not specify a maximum duration, Boundary uses the default value of 8 hours (28800 seconds).

   • -with-alias-authorize-session-host-id=<string> - The host ID that an alias uses to authorize sessions for the target.

   • -with-alias-scope-id=<string> - The scope ID that you want to create the target and alias in. The default is global. You can create aliases in the global and project scopes.

     You must create org and project suffixes before you can create an alias in the target's project scope. Otherwise, you can only create the alias in the global scope. Refer to Create a suffix for a scope for more information.

   • -with-alias-value=<string> - The value of the alias that you want to use to represent the target. Use this parameter to create the alias and target, and associate them with each other, at the same time.

     If you are creating an alias for a target that resides in a project scope, you must append the org and project suffixes to the value using the format alias.projectsuffix.orgsuffix. The value must comply with DNS naming rules.

You can define a target and target alias using the Boundary Terraform provider:

resource "boundary_target" "windows_rdp" {
  name         = "windows-server-2025"
  description  = "RDP target"
  type         = "rdp"
  address      = "10.0.0.20"
  default_port = "3389"
  scope_id     = boundary_scope.project.id
  injected_application_credential_source_ids = [
    boundary_credential_username_password.windows_rdp_creds.id
  ]
}

resource "boundary_alias_target" "windows_target_alias" {
  name                      = "windows-server-2025-alias"
  description               = "Target alias for windows-server-2025"
  scope_id                  = "global"
  value                     = "windows.2025"
  destination_id            = boundary_target.windows_rdp.id
}