Access a Windows server using RDP with Tailscale PAM

Last validated: Aug 17, 2026View as Markdown

Tailscale PAM is currently in beta.

Tailscale PAM lets users connect to Windows servers over Remote Desktop Protocol (RDP) using their Tailscale identity instead of sharing Windows usernames and passwords.

The Tailscale PAM connector handles authentication to the upstream Windows server on the user's behalf. Users don't need to know or manage the credentials for the Windows server.

You can use Tailscale grants to control who can access each RDP service. Tailscale PAM keeps a record of RDP connections so you can review who connected, from which device, and when.

Users can connect using an RDP client on their device or directly from their browser.

Prerequisites

Before you begin, make sure you have the following:

A Tailscale PAM connector that is installed and online.
A connector with network connectivity to the Windows server.
A Windows server with RDP enabled that the connector can reach.
The tailnet hostname or IP address of the Windows server.
The credentials Tailscale PAM should use to connect to the Windows server.
Tailscale installed and signed in on the device you'll use to connect, if you plan to use a native RDP client.

Create an RDP PAM service

To create a PAM service for your Windows server:

Open the Services page of the Tailscale admin console.
Select Add service.
Select PAM service.
Select RDP.
Select Continue.
Enter a name for the service.

Use a name that makes the Windows server suitable for users to recognize when they browse the services they can access.
(Optional) Enter a display name for the service.
(Optional) Enter a description service.
Select one or more Tailscale PAM connectors that can reach the Windows server.

Each connector you select must have network connectivity to the upstream Windows server.
Select Continue.
For Upstream hostname or IP, enter the hostname or IP address of the Windows server.
For Port, enter the RDP port. The default is 3389.
For Username, enter the Windows username Tailscale PAM should use when connecting to the server.
For Password, enter the password for the Windows user.
(Optional) For Domain, enter the Windows domain, if required by the server.

The username, password, and domain are used by the Tailscale PAM connector to authenticate to the upstream Windows server. Users connecting to the PAM service don't need access to these credentials.
Select Save.

Your RDP PAM service has been created. You can access it in the Services page of the admin console.

Grant access to the RDP service

Before users try to connect, make sure a Tailscale PAM grant gives them access to the RDP service. Tailscale PAM uses your tailnet access policy to determine which users, groups, devices, or tags can connect to the service.

For example, the following grant permits any source to connect to PAM RDP services:

"grants": [
  {
    "src": ["*"],
    "dst": ["*"],
    "ip": ["*"],

    "app": {
      "tailscale.com/cap/pam": [
        {
          "version": "v1",

          "permissions": {
            "rdp": {}
          }
        }
      ]
    }
  }
]

This is a broad grant that's useful for getting started. In a production environment, you can restrict the src and dst fields to control which users, groups, devices, or tags can access specific services.

For more information about controlling access to PAM services, refer to Control access to Tailscale PAM services.

For information about editing grants, refer to Edit access control policies in your tailnet policy file.

You can use the visual policy editor to manage your tailnet policy file. Refer to the visual editor reference for guidance on using the visual editor.

Connect to the Windows server

Users can connect using an RDP client on their device or directly from their browser.

Connect with an RDP client

The primary way to connect from your desktop is through the Tailscale client.

Open the Tailscale client.
Open Services.
Select the RDP service.
Choose an available RDP client.
When connecting, use an empty password. That is, don't provide a password.

Tailscale PAM uses your Tailscale identity to authorize the connection and handles the credentials required to connect to the upstream Windows server. This means users can access the Windows server without needing to know or manage its shared username and password.

Connect from the browser

You can also connect to the Windows desktop directly from the browser:

Open the Services page of the Tailscale admin console.
Select the RDP service you want to access.
Select Connect in the upper-right corner, and the web-based RDP client opens.
If prompted, authenticate with your Tailscale identity.

You can now use the Windows desktop directly from your browser.

The browser client appears as a Tailscale device in your tailnet. If device approval is enabled, an admin must approve the browser device before it can connect.

Secure the upstream credentials

In the example above, the Windows username and password are configured as part of the PAM service.

For production environments, you can instead configure Tailscale PAM to load credentials from a supported secret source. This lets you keep credentials in your existing secrets management system rather than storing them directly in the PAM service configuration.

The connector retrieves the credentials when they're needed and uses them to authenticate to the Windows server. Users connecting to the RDP service never need access to those credentials.

For more information, refer to Manage credentials and secrets.

Review RDP sessions

Tailscale PAM gives you centralized visibility into connections to your RDP services.

Open the Sessions page of the Tailscale admin console, then select a session for your RDP service.

You can review information such as:

The Tailscale identity that connected.
The originating device and source IP.
The connection time.
The RDP service that was accessed.
The duration of the session.
Whether the connection succeeded or was denied.

For more information, refer to Tailscale PAM session logs.

Troubleshooting

If you can't connect to your RDP service, first confirm that the PAM connector is online and can reach the Windows server on the configured RDP port.

Next, verify:

RDP is enabled on the Windows server.
The hostname or IP address and port are correct.
The configured Windows credentials are valid.
A Tailscale PAM grant gives your identity access to the RDP service.

If you're using a Windows domain account, also verify that the configured domain is correct.

If you're connecting from the browser and your tailnet uses device approval, confirm that the browser device has been approved.

If none of the troubleshooting steps mentioned above resolve your issue, review the connector logs and the details for the failed session in the PAM session logs. The session details can help determine whether the connection was blocked by access controls, network connectivity, or authentication to the upstream Windows server.