Connection settings window

Connection settings for a Windows VM

The Connection settings window lets you customize how IAP Desktop connects to your VMs. You can configure connection settings for individual VMs or entire zones or projects.

Connection settings support inheritance: If you configure a connection setting for a project, this setting applies to all zones and VMs in the project. Similarly, if you configure a connection setting for a zone, it applies to all VMs in that zone:

Settings inheritance

You can override inherited settings at lower levels. Whenever a setting deviates from the (inherited) default, its value is shown in bold typeface.

Connection settings are stored on your local computer and don't affect the configuration of the remote VM.

Windows Credentials

These settings control which user account you log on with. If you don't configure Windows credentials, IAP Desktop might prompt you for credentials when you first try to connect.

You can use the following types of user accounts:

a local Windows user account
an Active Directory user account

The user account must have permission to use Remote Desktop. Typically, this requires that the user is either a member of the Administrators group or the Remote Desktop users group.

Setting	Description	Required
Username	Username or UPN, for example `bob` or `bob@example.com`.	No
Password	Account password	No
Domain	Leave blank if you're using an UPN as username Use the NetBIOS domain name if the username is a NetBIOS username Use `.` if you're using a local Windows user account	No

Remote Desktop Connection

These settings control how IAP Desktop connects to your VM. You can let IAP Desktop connect in one of two ways:

IapTunnel: By default, IAP Desktop connects to the internal IP address of your VM through an IAP-TCP forwarding tunnel .
Vpc: Alternatively, you can let IAP Desktop connect to the VM's internal IP address through Cloud VPN or Interconnect. If you use this option, IAP Desktop doesn't use IAP-TCP forwarding.

Setting	Description	Required
Connect via	Controls how IAP Desktop connects to your VM, see description above.	Yes
Connection timeout	Timeout for connecting to the VM, in seconds.	Yes
Server port	Port to connect to, typically `3389`.	Yes

Remote Desktop Display

These settings control the display settings for Remote Desktop.

Setting	Description	Required
Color depth	Color depth to use.	Yes
Connection bar	Controls the behavior of the connection bar that's shown when you set the Remote Desktop session to full-screen.	Yes

Remote Desktop Resources

These settings control which local and remote resources you want to share.

Setting	Description	Required
Audio mode	Controls where to play back audio.	Yes
Windows shortcuts	Controls whether IAP Desktop should send Windows shortcuts (such as `Win+R`) to the VM: Disabled: Don't capture shortcuts and handle them locally instead. Enabled: Always capture shortcuts and handle them remotely. FullScreenOnly: Only capture shortcuts when the Remote Desktop session is in full-screen mode.	Yes
Redirect clipboard	Share the local clipboard with the remote VM.	Yes
Redirect printers	Share local printers with the remote VM.	Yes
Redirect smart cards	Share local smart cards with the remote VM.	Yes
Redirect local ports	Share local ports with the remote VM.	Yes
Redirect drives	Share local drives with the remote VM.	Yes
Redirect devices	Share local devices with the remote VM.	Yes
Redirect WebAuthn authenticators	Share WebAuthn authenticators with the remote VM.	Yes

Remote Desktop Security Settings

These settings control which RDP security mechanism to apply.

Setting	Description	Required
Network level authentication	Controls whether to secure connection using network level authentication (NLA). Leave NLA enabled unless you're connecting to a VM that uses a custom credential service provider such as the Google Credential Provider for Windows. Disabling NLA automatically enables server authentication.	Yes
Server authentication	Controls whether to verify the VM's TLS certificate. By default, IAP Desktop connects to the VM through an IAP-TCP forwarding tunnel. Tunneled connections use a hostname such as `localhost:12345`, which is different from the VM's canonical hostname. Because of this mismatch, certificate verification is unlikely to succeed and therefore off by default.	Yes
Restricted Admin mode	Controls whether to use Restricted Admin mode, which disables the transmission of reusable credentials to the VM. To use Restricted Admin mode, you must ensure that the following prerequisites are met: You're using a user account that has local administrator privileges on the VM. You've configured the VM to permit Restricted Admin mode. If you don't meet these prerequisites, connecting to the VM might fail with the error Account restrictions are preventing this user from signing in.	Yes

SSH Connection

These settings control how IAP Desktop connects to your VM. The settings are analogous to the Remote Desktop Connection settings.

SSH Credentials

These settings control which user account you log on with, and which authentication method to use.

IAP Desktop supports the following SSH authentication methods:

publickey
password
keyboard-interactive

When you use publickey, IAP Desktop automatically publishes a public key to the VM, and uses the corresponding private key to authenticate. Depending on the VM's configuration, IAP Desktop uses either OS Login or metadata keys to publish the public key.

Setting	Description	Required
Public key authentication	Controls the authentication method to use: Enabled: Use `publickey` authentication and let IAP Desktop automatically create an SSH key and publish it using OS Login or metadata keys. Disabled: Use `password` or `keyboard-interactive`-based authentication.	Yes
Username	Linux/Unix username. This setting is ignored when using OS Login because OS Login automatically determines your username.	No
Password	Linux/Unix password	No