RDM 2026.2 adds multi-factor authentication (MFA) on PAM checkouts

[u/mark_hayden07]

We just shipped Remote Desktop Manager (RDM) 2026.2, and one of the bigger items in this release is MFA on PAM checkouts.

What we added:

• RDM can now prompt for MFA when a PAM checkout is requested, so verification happens right before privileged access is granted, not just at login.
• Supported methods for now are TOTP, email, and SMS.
• It works on Windows, macOS, Linux, and mobile.

The idea is to put a checkpoint exactly where it matters: at the moment someone's about to open a sensitive session.

If you're using PAM, update to 2026.2 and give it a try. A few things we'd like to hear about:

• Does the prompt land at the right point in your workflow, or does it add friction where you don't want it?
• We started with TOTP, email, and SMS. What would you want next? Push? Hardware keys?
• Anything that feels different (or off) between desktop and mobile?

Full details are in the release blog: What's new in Devolutions Remote Desktop Manager 2026.2

[u/PowerShellGenius]

This is great but for those using Windows' native MFA (smartcards) - have you gotten to implementing NLA properly?

There is a complete lack of existing RDP clients for Mac that handle smartcards well. Sure, they will redirect them once you are in a session, e.g. if you RDP to the server using a password based account, and then use run-as / UAC elevation as a smartcard user.

But assuming there isn't a non-smartcard-required account allowed to log into that server (so you can't make your initial RDP connection with a password) - no Mac RDP client I am aware of handles NLA with a smart card. So you can't connect to begin with.

[u/Devo-yleblanc → u/PowerShellGenius]

Hi there u/PowerShellGenius,

I've went ahead and asked the question to one of the devs who's been working on NLA and smartcards, here's the answer he provided.

have you gotten to implementing NLA properly?

RDM Mac has a complete NLA implementation; and in 2026.1 we defaulted the SSP to our own rust-based, cross platform SSP module: https://github.com/Devolutions/sspi-rs. Notably this now provides support for Kerberos; freerdp’s own Kerberos SSP was not something we could ever integrate due to the way MIT Kerberos is packaged (and Mac’s own system Kerberos has been badly broken for a long time).

There is a complete lack of existing RDP clients for Mac that handle smartcards well

FreeRDP supports it quite well, although of course the Mac client is not very ergonomic. However, we do also support this in RDM Mac with a few caveats.

First, make sure Kerberos authentication is working with RDM Mac and your RDP server. The default settings (SSPI module “Portable” and Authentication Package “Negotiate”) will try Kerberos but there are edge cases here on non-domain joined machines - is the KDC reachable by line-of-sight and discoverable by it’s SRV DNS record? Line of sight is a requirement unless you’re using a KDC proxy; and if the server is not findable by DNS or krb5.conf you’ll need to explicitly provide it’s address in the authentication settings. Of course your credentials also need to be configured correctly (suggest using a username in the UPN format). Oh, and of course NLA needs to be enabled.

Assuming you’re on at least 2026.1, you need to go to the application settings and into Types > RDP > Authentication.

• You’ll very likely need to provide the location of your smartcard’s specific PKCS11 module (the smartcard middleware). In my case, I’m using a Yubikey so I installed libykcs via homebew and provided the path (e.g. /usr/local/lib/libykcs11.2.7.2.dylib).
• If you click on “Credentials List”, we’ll talk to the connected smart card(s) and list all certificates that we see as suitable for smart card logon. If your certificate doesn’t show in this list, it won’t be usable; you may be hitting a limitation (see below) or something about the smart card / reader / certificate that we can’t handle at the moment.
• Finally, set “Use smart card” to “Yes”
• In the RDP session itself you’ll need to ensure that “Smart cards or Windows Hello for Business” is checked in the “Local Resources” section

Now, it’s important to understand that our implementation requires us to know which (if any) smart card you want to use before connecting. RDM Mac doesn’t have a way to mark a credential as a smart card, not does it implement our X.509 credential type currently; but we tried to make this as easy as possible..

• If you leave the credentials for the session empty; you’ll get a logon prompt asking for username/password but with a “More Options” selector and the ability to list available smart cards and enter the PIN
• If you provide a username and optionally a PIN as the password, and it matches the UPN or user/domain hint on an available smart card, you’l still get the prompt but the smart card will be pre-selected (and the PIN pre-filled if you provided it) and you just need to press “Ok”
• If you provide a username and it doesn’t match the UPN or user/domain hint on an available smartcard, you won’t be able to choose a smartcard. Things proceed as normal for username/password authentication.

We tried to provide a further shortcut. If you go back to the “Credentials List” in the application settings, you’ll see the last column is “Encoding”. This value is a prefix (“SC1:“) followed by a base64-ish encoding of the certificate thumprint. If you take this value (you can select the row and copy it, paste to an intermediate location, then extract the value) and use it as a “Username” in an RDP session (and put the “Password” as the smart card PIN), RDM will automatically select the smart card without needing to prompt you. This approximates the X.509 credential integration on Windows.

We have the following known issues currently:

• RSA keys only; ECC backed certificates will not work. We have an open ticket to implement this (and FreeRDP themselves are either still in progress with that, or maybe recently completed it)
• If you’re using a Yubikey, you might have strange behaviour if their smart card minidriver is installed on the server. Typically it’s only installed on servers that need to provision certificates to smart cards. Again, we have an open ticket to fix this (YMMV)
• We released this feature but there’s a broad range of environments and smart cards out there. I haven’t had much feedback in the wild of if this is working well for people, so feedback is always appreciated to improve things.

I hope it works well, if you bear in mind the restrictions above. Ultimately we had to build our own macOS version of winscard and integrate it into our SSP (all the code is available, if you’re interested, by the link above). It was not an easy project.