Architecture
Gateway RDP Proxy
Zero-Day Shield

Replace Traditional RDP Jump Boxes and Bastion Hosts with Identity-Aware Gateway RDP Proxy

Eliminate RDP jump boxes and bastion hosts. OnePAM's gateway RDP proxy provides SAML/OIDC SSO, MFA, session recording, and zero-day protection — without managing jump servers.

From Jump Boxes to Identity-Aware RDP Gateway

Organizations have relied on RDP jump boxes (bastion hosts) for decades as a way to centralize and control Windows server access. But jump boxes are fundamentally flawed: they use password authentication, lack session recording, require their own patching and maintenance, and become single points of failure and compromise. A compromised jump box gives attackers access to every server behind it. OnePAM's gateway RDP proxy replaces jump boxes with a modern, identity-aware alternative. Instead of maintaining a Windows Server as a jump point, OnePAM provides a purpose-built gateway that authenticates users via SAML/OIDC, enforces MFA, records sessions, and proxies RDP connections to target servers.

Gateway RDP Proxy

Run a dedicated OnePAM gateway with native RDP protocol support. Users authenticate via SAML/OIDC at the gateway, which brokers the RDP session using Kerberos NLA. No agent needed on target servers.

Why RDP Jump Boxes Are a Liability

Without identity-based RDP access, these risks threaten your Windows servers every day.

Jump boxes are Windows servers with their own RDP vulnerabilities — they're attack targets, not security controls
A compromised jump box provides lateral access to every server behind it
Jump boxes use password authentication and rarely have MFA
Jump boxes require patching, monitoring, and maintenance — operational overhead that scales

RDP Security Challenges

These are the risks organizations face with traditional RDP authentication.

Jump Box = Attack Target

A jump box is a Windows server with RDP exposed. It has its own CVEs, patches, and is often the most exposed server.

Credential Reuse

Users authenticate to the jump box with AD credentials, then use the same credentials to RDP to target servers.

No Session Recording

Jump boxes don't record sessions. What happens after the user RDPs to the target server is invisible.

Operational Burden

Jump boxes need Windows updates, antivirus, monitoring, backup, and capacity management.

Single Point of Compromise

If the jump box is compromised, the attacker has a staging point with access to all target servers.

No IdP Integration

Jump boxes authenticate via AD. No SAML/OIDC SSO, no IdP-enforced MFA.

How OnePAM Replaces Jump Boxes

Step-by-step guide to deploying identity-based Windows RDP access.

1

Deploy OnePAM Gateway

Deploy a OnePAM gateway as the centralized RDP entry point — replacing all jump boxes.

The OnePAM gateway is a purpose-built access proxy, not a general-purpose Windows server.
2

Configure SSO Authentication

Connect OnePAM to your corporate IdP for SAML/OIDC authentication with MFA.

Authentication happens via your IdP — not via shared AD credentials on a jump box.
3

Define Server Access Policies

Create per-user, per-server access policies with MFA requirements.

Granular policies replace the coarse access model of jump boxes.
4

Enable Session Recording

Record every RDP session at the gateway level with full identity metadata.

OnePAM records the actual RDP session to the target server — not just the jump box session.
5

Decommission Jump Boxes

Once OnePAM is handling all RDP access, decommission your jump boxes.

Each decommissioned jump box removes a Windows server from your environment.

Why Gateway > Jump Box

Measurable security and operational outcomes from deploying OnePAM Windows RDP SSO.

Eliminate Jump Box Risk

Remove Windows jump boxes from your environment. Each was an RDP-vulnerable server and potential pivot point.

Zero jump box attack surface

Identity-Verified Access

Replace AD password authentication with SAML/OIDC SSO and MFA.

Verified identity on every session

Built-In Session Recording

OnePAM records the session to the target server — not just the jump box.

True session recording

Reduce Operational Overhead

No more patching, monitoring, and maintaining jump box servers.

Fewer servers to manage

Granular Access Policies

Replace 'jump box access = all server access' with per-user, per-server policies.

Least-privilege enforcement

Zero-Day Protection Included

OnePAM's gateway prevents RDP exploits from reaching target servers.

Architectural exploit prevention

Windows RDP SSO Capabilities

Every feature needed for enterprise-grade Windows RDP authentication.

Native RDP protocol implementation — purpose-built gateway, not a Windows server
Kerberos NLA authentication to target servers with Protected User support
SAML/OIDC SSO replacing jump box AD authentication
MFA enforcement on every RDP session
Visual session recording to target servers
Per-user, per-server access policies
Network isolation of target servers
Centralized audit trail
Browser-based RDP access option
API-driven access management

Zero-Day Protection Features

Enterprise-grade security controls for RDP access.

Minimal attack surface — native Go binary, no Java/Tomcat
Kerberos NLA prevents NTLM credential exposure
Purpose-built proxy with hardened runtime
Network isolation enforcement
No credential caching on the gateway
Automatic session termination

Jump Box Replacement Use Cases

Common scenarios where organizations deploy OnePAM Windows RDP SSO.

1
Replacing Windows jump boxes in data centers with OnePAM's identity-aware RDP gateway
2
Eliminating bastion hosts in cloud environments (Azure, AWS) with gateway-based RDP access
3
Reducing server fleet count by decommissioning jump box VMs
4
Upgrading from shared-credential jump box access to individual MFA-verified RDP sessions
5
Adding session recording to server access that was previously unmonitored through jump boxes
6
Closing the pivot-point risk of compromised jump boxes in pen test findings

Replace RDP Jump Boxes with SSO Platform FAQ

Common questions about Windows RDP SSO and zero-day protection.

How is OnePAM's gateway different from a jump box?

A jump box is a general-purpose Windows server with RDP exposed. OnePAM's gateway is a purpose-built access proxy that doesn't expose RDP, authenticates via SAML/OIDC, enforces MFA, and records sessions.

Can OnePAM replace Azure Bastion?

OnePAM provides similar functionality but with SAML/OIDC SSO from any IdP, session recording, and works across cloud providers and on-premise.

How many target servers can one gateway support?

A single OnePAM gateway can proxy RDP connections to hundreds of target servers.

Can I use OnePAM alongside an existing PAM solution?

Yes. OnePAM can complement existing PAM solutions or serve as a full PAM replacement for RDP.

Your Jump Boxes Are a Liability. Replace Them.

OnePAM's gateway RDP proxy provides SSO, MFA, session recording, and zero-day protection — without the risk of jump boxes.