Set RD Gateway authentication method
Verified with Windows 11 25H2 — updated on July 30, 2026
Supported on: At least Windows Server 2003 operating systems with SP1 or Windows XP Professional with SP2
Path in the GPO console
User Configuration\Administrative Templates\Windows Components\Remote Desktop Services\RD Gateway Description
Specifies the authentication method that clients must use when attempting to connect to an RD Session Host server through an RD Gateway server. You can enforce this policy setting or you can allow users to overwrite this policy setting. By default, when you enable this policy setting, it is enforced. When this policy setting is enforced, users cannot override this setting, even if they select the "Use these RD Gateway server settings" option on the client. To allow users to overwrite this policy setting, select the "Allow users to change this setting" check box. When you do this, users can specify an alternate authentication method by configuring settings on the client, using an RDP file, or using an HTML script. If users do not specify an alternate authentication method, the authentication method that you specify in this policy setting is used by default. If you disable or do not configure this policy setting, the authentication method that is specified by the user is used, if one is specified. If an authentication method is not specified, the Negotiate protocol that is enabled on the client or a smart card can be used for authentication.
Registry
SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services MDM / Intune (CSP)
./User/Vendor/MSFT/Policy/Config/ADMX_TerminalServer/TS_GATEWAY_POLICY_AUTH_METHOD Microsoft Learn documentation Mapping data: Microsoft Learn (CC BY 4.0)
Export Builder
BETAConfigure the state, scope and options, then generate .reg, PowerShell, Intune and SCCM outputs — or add the setting to a multi-setting collection.
These exports write the registry — this is not a managed GPO. ⓘ
.reg file
Windows Registry Editor Version 5.00
; Exported from gporais.com
; Policy: Set RD Gateway authentication method
; State: Enabled
; Supported on: At least Windows Server 2003 operating systems with SP1 or Windows XP Professional with SP2
[HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services]
"AllowExplicitLogonMethod"=dword:00000000
"LogonMethod"=dword:00000005More formats (PowerShell, Intune, SCCM)
PowerShell
# Exported from gporais.com
# Policy: Set RD Gateway authentication method
# State: Enabled
# Supported on: At least Windows Server 2003 operating systems with SP1 or Windows XP Professional with SP2
# Warning: In SYSTEM context (the Intune default), HKCU targets the SYSTEM profile. Run this script using the logged-on credentials.
$path = 'HKCU:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'AllowExplicitLogonMethod' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'LogonMethod' -Value 5 -Type DWordIntune XML
OMA-URI: ./User/Vendor/MSFT/Policy/Config/ADMX_TerminalServer/TS_GATEWAY_POLICY_AUTH_METHOD
Data type: String
Value:
<enabled/>
<data id="TS_GATEWAY_OVERRIDE" value="0"/>
<data id="TS_GATEWAY_AUTH_MODE" value="5"/>Intune Remediation
# === Detection script ===
# Exported from gporais.com
# Policy: Set RD Gateway authentication method
# State: Enabled
# Supported on: At least Windows Server 2003 operating systems with SP1 or Windows XP Professional with SP2
# Warning: In SYSTEM context (the Intune default), HKCU targets the SYSTEM profile. Run this script using the logged-on credentials.
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
$checks = @(
(Test-RegistryValue -Path 'HKCU:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services' -Name 'AllowExplicitLogonMethod' -Expected 0 -Kind DWord)
(Test-RegistryValue -Path 'HKCU:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services' -Name 'LogonMethod' -Expected 5 -Kind DWord)
)
if ($checks -notcontains $false) {
Write-Output 'Compliant'
exit 0
}
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: Set RD Gateway authentication method
# State: Enabled
# Supported on: At least Windows Server 2003 operating systems with SP1 or Windows XP Professional with SP2
# Warning: In SYSTEM context (the Intune default), HKCU targets the SYSTEM profile. Run this script using the logged-on credentials.
$path = 'HKCU:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'AllowExplicitLogonMethod' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'LogonMethod' -Value 5 -Type DWordSCCM scripts
# Exported from gporais.com
# Policy: Set RD Gateway authentication method
# State: Enabled
# Supported on: At least Windows Server 2003 operating systems with SP1 or Windows XP Professional with SP2
# SCCM Configuration Item guidance:
# Create a Configuration Item of type "Setting: Script".
# Discovery script: use the Detection script below.
# Remediation script: use the Remediation script below.
# Compliance rule: the Discovery script output equals 'Compliant'.
# === Detection script ===
# Exported from gporais.com
# Policy: Set RD Gateway authentication method
# State: Enabled
# Supported on: At least Windows Server 2003 operating systems with SP1 or Windows XP Professional with SP2
# Warning: In SYSTEM context (the Intune default), HKCU targets the SYSTEM profile. Run this script using the logged-on credentials.
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
$checks = @(
(Test-RegistryValue -Path 'HKCU:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services' -Name 'AllowExplicitLogonMethod' -Expected 0 -Kind DWord)
(Test-RegistryValue -Path 'HKCU:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services' -Name 'LogonMethod' -Expected 5 -Kind DWord)
)
if ($checks -notcontains $false) {
Write-Output 'Compliant'
exit 0
}
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: Set RD Gateway authentication method
# State: Enabled
# Supported on: At least Windows Server 2003 operating systems with SP1 or Windows XP Professional with SP2
# Warning: In SYSTEM context (the Intune default), HKCU targets the SYSTEM profile. Run this script using the logged-on credentials.
$path = 'HKCU:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'AllowExplicitLogonMethod' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'LogonMethod' -Value 5 -Type DWordBuilding a multi-setting collection? Add this setting and generate combined .reg / PowerShell / GPO scripts.