SSH agent forwarding is not natively supported by Remote Desktop Protocol (RDP) on Windows 10, meaning you cannot directly forward your local SSH private keys to a remote session for transparent authentication. To achieve similar functionality, you must use alternative mechanisms such as Group Policy Object configurations to allow credential delegation or employ third-party tools that integrate with the Windows Credential Manager.
Understanding the Limitations of RDP and SSH
Remote Desktop Protocol operates at a different layer than SSH. While SSH agent forwarding relies on a Unix-like socket connection to relay authentication requests, RDP uses NTLM or Kerberos authentication against the Windows domain or local SAM database. Consequently, there is no built-in "ForwardAgent yes" equivalent in the
mstsc.exe client or server configuration files. Attempting to inject SSH keys via environment variables or clipboard manipulation is insecure and unreliable, as these methods bypass the secure hardware-backed key storage provided by modern Windows features.
Using Group Policy for Credential Delegation
If your goal is to authenticate to other servers from within an RDP session without re-entering credentials, you should configure CredSSP (Credential Security Support Provider). This allows the client to send credentials to the remote server, which can then delegate them to other targets. However, this requires careful security configuration to prevent pass-the-hash attacks.
Navigate to
Local Security Policy or your Domain Group Policy Editor. Go to
Computer Configuration >
Administrative Templates >
System >
Credentials Delegation. Enable the policy
Allow Delegating Fresh Credentials. In the settings, add the SPN target for the destination services, typically using
WSMAN/* or specific server names. This method ensures that credentials are encrypted during transmission and validated by the receiving service, offering a more secure path than manual key injection.
Leveraging Windows Hello for Business
For organizations already utilizing Azure AD or Active Directory, Windows Hello for Business provides a robust solution. When enabled, smart card or biometric-based certificates are stored securely in the TPM. If your remote infrastructure supports certificate-based authentication, you can configure the RDP gateway to accept these certificates. This eliminates the need for password entry entirely and avoids the complexities of SSH key management within a Windows desktop environment.
Alternative: Using OpenSSH Server on the Remote Host
If you strictly require SSH access from within the RDP session, consider installing the OpenSSH Server feature on the remote Windows 10 machine. You can manually copy your public keys to the
C:\Users\\.ssh\authorized_keys file on the remote host. While this does not forward the agent, it allows you to connect via SSH from inside the RDP session using the pre-deployed keys. This approach isolates the private keys on the remote machine, reducing the risk of exposure if the local machine is compromised. For more details on managing SSH connections on Windows, see
SSH Connection: Windows 10 Wi-Fi vs. Ethernet.
Secure Clipboard and File Transfer Alternatives
Often, users seek credential forwarding to facilitate file transfers or clipboard sharing between local and remote machines. RDP handles clipboard redirection natively if configured correctly. Ensure that in the
mstsc options under the
Local Resources tab,
Clipboard is checked. For file transfers, use the
Drives redirection feature. This is far more secure than copying SSH config files or keys via text editors, which might leave residual data in temporary folders. If you encounter issues with clipboard functionality, refer to our guide on
copy-files-with-remote-desktop to troubleshoot common redirection failures.
Risks of Workaround Methods
Avoid using scripts that write private keys to disk or modify registry entries to simulate agent forwarding. These methods often store keys in plaintext or weakly encrypted formats, violating best practices for key management. Additionally, some third-party utilities claim to bridge SSH and RDP but may introduce supply chain risks or malware vectors. Always prefer native Windows security features like CredSSP, Certificate Authentication, or explicit key deployment over hacky workarounds.
Frequently Asked Questions
Can I enable SSH Agent Forwarding in mstsc.exe?
No, the Microsoft Remote Desktop client does not support SSH agent forwarding because RDP and SSH use fundamentally different authentication protocols. You must rely on native Windows credential delegation or manual key deployment instead.
Is it safe to store SSH private keys on the remote RDP server?
It is moderately safe if the remote server is hardened and the keys are protected with strong passphrases, but it is less secure than agent forwarding. The primary risk is that if the remote session is compromised, the attacker gains direct access to the keys stored on that machine.
How do I fix RDP clipboard redirection issues?
Check the Local Resources tab in the Remote Desktop Connection client and ensure the Clipboard option is selected. On the server side, verify that the
rdpclip.exe process is running and that Group Policy restrictions are not blocking clipboard access.
What is CredSSP and why do I need it?
CredSSP is a protocol that allows clients to provide credentials to remote servers for authentication to other network resources. Enabling it via Group Policy permits seamless single sign-on experiences when accessing secondary servers from within an RDP session.
Does Windows 10 Home support Group Policy editing?
Windows 10 Home edition does not include the full Group Policy Editor. Users on Home editions must use Registry Editor manually to apply CredSSP settings, which carries a higher risk of system instability if done incorrectly.