IAP Desktop

IAP Desktop is a Windows application that lets you manage multiple Remote Desktopconnections to Windows VM instances. IAP Desktop connects to VM instancesby usingIdentity-Aware Proxy TCP forwardingand does not require VM instances to have a public IP address.

Before you connect by using IAP Desktop, make sure that thefollowing prerequisites are met:

• You've configured your VPC toallow IAP traffic to your VM instance.
• You'vedownloaded and installed IAP Desktop on your local computer.

To connect to a VM instance by using IAP Desktop, do the following:

1. In IAP Desktop, selectProfile >Add project.

2. Enter the ID or name of your project, and clickOK.

3. In theProject Explorer window, right-click the VM instance youwant to connect to and selectConnect.

   

For more information about IAP Desktop, see theGitHub projectpage.

Remote Desktop Connection app

You can use the Microsoft Remote Desktop Connection app that is part ofWindows to connect to Windows instances.

Before you connect using the Microsoft Remote Desktop Connection app, makesure that one of the following prerequisites is met:

• Your VM instance has a public IP address and yourfirewallrulesallow TCP ingress traffic from your client's public IP address tothe instance by using port 3389.
• Your local network is connected to your VPC by usingCloud VPN orCloud Interconnectand yourfirewallrulesallow TCP ingress traffic from your client's private IP address tothe instance by using port 3389.

To connect with Microsoft Windows Remote Desktop, do the following:

1. Create a Windows account andpasswordif you do not have one yet.

2. To connect over the internet, use theexternal IP address.To connect by using Cloud VPN or Cloud Interconnect, use theinternal IP address.

   Identify the external and internal IP addresses of your Windows instanceby completing one of the following steps:

   • In the Google Cloud console, go to theVM instances page.

     Go to the VM instances page

   • By using the gcloud CLI, rungcloud compute instances list:

     gcloud compute instances list

3. Open Microsoft Windows Remote Desktop Connection on your Windows machine.You can find the executable at%systemroot%\system32\mstsc.exe

   

4. In theComputer box, enter the IP address.

   If you've configured your instance to use a different port number forRDP, add it after the IP address, for example:1.2.3.4:3389.

5. ClickConnect.

6. Enter your username and password, and clickOK.

   If you have forgotten your password, you canreset it.

Chrome Remote Desktop

Chrome Remote Desktopis a service that lets you remotely access anothercomputer by using a web browser.Chrome Remote Desktop works on Windows, macOS, and Linux and does not requirethe VM instance to have a public IP address.

Before you connect by using Chrome Remote Desktop, make sure that thefollowing prerequisites are met:

• You'vecreated a Windows account andpasswordon the VM instance.
• You'veinstalled the Chrome Remote Desktop service on the VMinstance.

To connect to a VM instance by using Chrome Remote Desktop, do thefollowing:

1. On your local computer, go to theChrome Remote Desktop website.

2. If you're not already signed in to Google, sign in with the same GoogleAccount that you used to set up the Chrome Remote Desktop service.

3. Select the instance that you want to connect to.

4. When you're prompted, enter the PIN that you created when installingthe Chrome Remote Desktop service, and click thearrow_forward arrow buttonto connect.

Other

You can connect to your Windows VM instances by using other RDP clients,such as clients developed for Android, iOS, Mac, and others. For a list ofofficially supported clients, seeMicrosoft Remote Desktopclients.

Before you connect, make sure that one of the following prerequisites ismet:

• Your VM instance has a public IP address and yourfirewall rulesallow TCP ingress traffic from your client's public IP address tothe instance by using port 3389.
• Your local network is connected to your VPC by usingVPN orCloud Interconnectand yourfirewall rulesallow TCP ingress traffic from your client's private IP address tothe instance by using port 3389.

To connect using other RDP clients, do the following:

1. To connect over the internet, use theexternal IP address.To connect by using Cloud VPN or Cloud Interconnect, use theinternal IP address.

   Identify the external and internal IP addresses of your Windows instanceby completing one of the following steps:

   • In the Google Cloud console, go to theVM instances page.

     Go to the VM instances page

   • By using the gcloud CLI, rungcloud compute instances list:

     gcloud compute instances list

2. Install the supported client according to the client's installationinstructions.

3. Connect using the IP address of your instance, and authenticatewith your username and password for the instance.

Serial port

1. Verify the RDP certificate byviewing the output from serial port1during the initial boot of the Windows VM.

2. Examine the output of serial port 1 during the initial boot of theWindows VM for the following:

   Serial port 1 (console) output for rdp-test......2021/03/31 15:53:58 GCEInstanceSetup: RDP certificate details: Subject: CN=rdp-test, Thumbprint: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX......

PowerShell from the SAC

1. Connect to the Windows SAC.

2. Run the following PowerShell commands:

   # WinRM CertWrite-Host 'WinRM certificate details:'; Get-ChildItem 'Cert:\LocalMachine\My' | Where-Object { $_.Subject -like "CN=$env:COMPUTERNAME*" -and $_.NotAfter -gt $(Get-Date) -and $_.HasPrivateKey} |  Select-Object Subject, Thumbprint | Format-List# RDP CertWrite-Host 'RDP certificate details:'; Get-ChildItem 'Cert:\LocalMachine\Remote Desktop\' | Where-Object { $_.Subject -like "CN=$env:COMPUTERNAME*" -and $_.NotAfter -gt $(Get-Date) -and $_.HasPrivateKey} |  Select-Object Subject, Thumbprint | Format-List

   What's next