Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

You have to repeat this on every remote computer and every Hyper-V VM that requires redirected WebAuthn.

Sanity Check - Although this is described as a “device redirection”, and you can actually redirect devices (like a WebCam, if for some reason you wanted to), what we are really doing here is tunnelling between machines the connection between the Browser and the Authenticator (Security Key or Passkey). While it is true that the Yubikey is also a USB device, a Phone doing Passkey authentication is connected by BlueTooth and cannot be redirected as a device. Microsoft has chosen not to create a separate Group Policy and RDC checkbox for USB device sharing and tunnelling the program to program communication from the Browser to the Authenticator-selection dialog of Windows. Both are included in “Plug and Play device redirection” option even though program to program protocol tunneling is not really a device redirection.

Use

Use Remote Desktop Connection with the redirected WebAuthn share to connect to the remote computer or VM. On the remote computer begin the login to the service that requires the Security Key or Passkey authentication. The security key or passkey selection dialog will pop up on your local computer screen, not on the remote screen. Therefore, it would probably be confusing if you tried to do this with the Remote Desktop in Fullscreen mode, because you need access to both the remote and local desktops to complete the login.

Yale ITS PROD AD Group Policy configuration

...

The only program that supports the protocol today is C:\Windows\System32\mstsc.exe (Remote Desktop Connection), which means that a Hyper-V VM has to have a virtual network connection to between it and the Host computer.