Use IP Address Redirection
Verified with Windows 11 25H2 — updated on July 30, 2026
Supported on: At least Windows Server 2003, Enterprise Edition
Path in the GPO console
Computer Configuration\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\RD Connection Broker Description
This policy setting allows you to specify the redirection method to use when a client device reconnects to an existing Remote Desktop Services session in a load-balanced RD Session Host server farm. This setting applies to an RD Session Host server that is configured to use RD Connection Broker and not to the RD Connection Broker server. If you enable this policy setting, a Remote Desktop Services client queries the RD Connection Broker server and is redirected to their existing session by using the IP address of the RD Session Host server where their session exists. To use this redirection method, client computers must be able to connect directly by IP address to RD Session Host servers in the farm. If you disable this policy setting, the IP address of the RD Session Host server is not sent to the client. Instead, the IP address is embedded in a token. When a client reconnects to the load balancer, the routing token is used to redirect the client to their existing session on the correct RD Session Host server in the farm. Only disable this setting when your network load-balancing solution supports the use of RD Connection Broker routing tokens and you do not want clients to directly connect by IP address to RD Session Host servers in the load-balanced farm. If you do not configure this policy setting, the Use IP address redirection policy setting is not enforced at the group Group policy Policy level and the default will be used. This setting is enabled by default. Notes: 1. For Windows Server 2008, this policy setting is supported on at least Windows Server 2008 Standard.
Registry
SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services Value name: SessionDirectoryExposeServerIP
Enabled: SessionDirectoryExposeServerIP = 1
Disabled: SessionDirectoryExposeServerIP = 0
MDM / Intune (CSP)
./Device/Vendor/MSFT/Policy/Config/ADMX_TerminalServer/TS_SD_EXPOSE_ADDRESS Microsoft Learn documentation Mapping data: Microsoft Learn (CC BY 4.0)
Export Builder
BETAConfigure the state, scope and options, then generate .reg, PowerShell, Intune and SCCM outputs — or add the setting to a multi-setting collection.
These exports write the registry — this is not a managed GPO. ⓘ
.reg file
Windows Registry Editor Version 5.00
; Exported from gporais.com
; Policy: Use IP Address Redirection
; State: Enabled
; Supported on: At least Windows Server 2003, Enterprise Edition
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services]
"SessionDirectoryExposeServerIP"=dword:00000001More formats (PowerShell, Intune, SCCM)
PowerShell
# Exported from gporais.com
# Policy: Use IP Address Redirection
# State: Enabled
# Supported on: At least Windows Server 2003, Enterprise Edition
$path = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'SessionDirectoryExposeServerIP' -Value 1 -Type DWordIntune XML
OMA-URI: ./Device/Vendor/MSFT/Policy/Config/ADMX_TerminalServer/TS_SD_EXPOSE_ADDRESS
Data type: String
Value:
<enabled/>Intune Remediation
# === Detection script ===
# Exported from gporais.com
# Policy: Use IP Address Redirection
# State: Enabled
# Supported on: At least Windows Server 2003, Enterprise Edition
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
$checks = @(
(Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services' -Name 'SessionDirectoryExposeServerIP' -Expected 1 -Kind DWord)
)
if ($checks -notcontains $false) {
Write-Output 'Compliant'
exit 0
}
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: Use IP Address Redirection
# State: Enabled
# Supported on: At least Windows Server 2003, Enterprise Edition
$path = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'SessionDirectoryExposeServerIP' -Value 1 -Type DWordSCCM scripts
# Exported from gporais.com
# Policy: Use IP Address Redirection
# State: Enabled
# Supported on: At least Windows Server 2003, Enterprise Edition
# SCCM Configuration Item guidance:
# Create a Configuration Item of type "Setting: Script".
# Discovery script: use the Detection script below.
# Remediation script: use the Remediation script below.
# Compliance rule: the Discovery script output equals 'Compliant'.
# === Detection script ===
# Exported from gporais.com
# Policy: Use IP Address Redirection
# State: Enabled
# Supported on: At least Windows Server 2003, Enterprise Edition
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
$checks = @(
(Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services' -Name 'SessionDirectoryExposeServerIP' -Expected 1 -Kind DWord)
)
if ($checks -notcontains $false) {
Write-Output 'Compliant'
exit 0
}
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: Use IP Address Redirection
# State: Enabled
# Supported on: At least Windows Server 2003, Enterprise Edition
$path = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'SessionDirectoryExposeServerIP' -Value 1 -Type DWordBuilding a multi-setting collection? Add this setting and generate combined .reg / PowerShell / GPO scripts.