RDP Client for Chrome

• Configuring app permissions in Google Admin console
• Azure Virtual Desktop instructions
• Copying files between Chrome OS and a remote desktop session
• Configuring the app on managed devices
• USB device redirection
• Kerberos Authentication
• How to Manage Isolated Web App (IWA) Versions in Google Workspace

Local network permission:
Google Admin console > Devices > Chrome > Settings > select ‘Users’ OU > Users & browsers > Local Network URLs > “Network access from websites matching these origins to local network endpoints are not subject …” > add isolated-app://q2oy25prsvhmxocjxs2badhyi3uw7vqhrupfn66iflserug4st6qaaic

Clipboard permission:
Google Admin console > Devices > Chrome > Settings > select ‘Users’ OU > Users & browsers > Clipboard > “Allow these sites to access clipboard” > add isolated-app://q2oy25prsvhmxocjxs2badhyi3uw7vqhrupfn66iflserug4st6qaaic

Advanced printer features permission:
Google Admin console > Devices > Chrome > Web capabilities > Add origin (or edit if already added) isolated-app://q2oy25prsvhmxocjxs2badhyi3uw7vqhrupfn66iflserug4st6qaaic
For the origin, set “Web printing” to Allowed

Pop-ups and redirection permission:
Google Admin console > Devices > Chrome > Settings > select ‘Users’ OU > Users & browsers > Pop-ups > add isolated-app://q2oy25prsvhmxocjxs2badhyi3uw7vqhrupfn66iflserug4st6qaaic

Window management permission:
Google Admin console > Devices > Chrome > Web capabilities > Add origin (or edit if already added) isolated-app://q2oy25prsvhmxocjxs2badhyi3uw7vqhrupfn66iflserug4st6qaaic
For the origin, set “Window management” to Allowed

Automatic full screen permission:
Google Admin console > Devices > Chrome > Web capabilities > Add origin (or edit if already added) isolated-app://q2oy25prsvhmxocjxs2badhyi3uw7vqhrupfn66iflserug4st6qaaic
For the origin, set “Automatic fullscreen” to Allowed

In order for the Xtralogic RDP client app to be able to connect to Azure Virtual Desktop resources,
an AVD admin has to explicitly enable connections from the app. The AVD admin should follow these instructions:

1. Login at https://portal.azure.com/ with the admin account for the AVD infrastructure.
2. Go to “Microsoft Entra ID” at the top row.
3. In the left pain go to “Manage > Devices”.
4. In the left pain go to “Manage > Remote Connection Configuration”.
5. Click on “Microsoft Remote Desktop”.
6. Set “Enable Microsoft Entra ID authentication protocol to authenticate users to remote devices” to Yes.
7. Click on “Client app(s) to connect to target server resource”.
8. Search for “bcc38398-aaa1-4804-892f-ae132cc39742”, you should find “Xtralogic RDP Client”, select it and save.
9. If the app is not found, it means no users tried to use the app yet, its service principal needs to be added first. Here is how to do that using Powershell:

   Install-Module Microsoft.Graph -Scope CurrentUser  # if not already installed
   Connect-MgGraph -Scopes "Application.ReadWrite.All"
   New-MgServicePrincipal -AppId "bcc38398-aaa1-4804-892f-ae132cc39742".
   

To support file transfer between the local Chrome OS filesystem and a remote computer, the Xtralogic RDP Client version 4.X uses Xtralogic File System Provider extension.
The extension implements a filesystem that is accessible through the Files app on the Chromebook and at the same time is redirected by Xtralogic RDP Client to the remote RDP session.
The filesystem is not persistent, copied files are only available while a remote desktop session in Xtralogic RDP Client is active or within 30 seconds of an inactivity in the Files app.

To copy a file to a remote desktop session:

• Install Xtralogic File System Provider extension.
• In the Xtralogic RDP client, on the Resources tab in the saved connection settings, select “Enable browser filesystem redirection”. It will show a link to the extension if it is not installed.
• Establish remote desktop session in Xtralogic RDP Client.
• Start the Chrome OS Files app. If the Xtralogic File System is not available in the left pain, go to Menu > Services > Xtralogic File System. The Xtralogic File System will become available in the left pane of the Files app. Usually this needs to be done only once.
• In the Chrome OS Files app, copy a file to the Xtralogic File System.
• In the remote desktop session in Xtralogic RDP Client, in Windows Explorer, open “Filesytem on Xtralogic on RDP Client” drive, or go to Network > tsclient > \\tsclient\filesystem, or, if the drive already open, do Refresh (right click > Refresh).

On managed Chrome devices Xtralogic RDP client version 4.X can be configured using a Google Admin console policy.

The configuration is done indirectly, using Xtralogic Enterprise Provider Chrome extension. The extension will get the configuration and provide it to the Xtralogic RDP client app. Install the extension in the Google Workspace admin console. Select “Force install” installation policy for the extension. The extension id is agjnbnikgbndfmjcojfmikmbimmhomlb.

The configuration policy for the extension has the same JSON format as is used for the legacy Chrome app. Download an example of the configuration policy.

A .rdp file content for an RDP connection can be copy/pasted into “dotRdpFileContent” JSON element of the configuration policy, but to comply with the JSON format, new line characters in .rdp file content have to be replaced with ‘\r\n ‘ sequence of characters. The “dotRdpFileContent” JSON element can contain any valid .rdp file configuration options, not only the ones used in the example.

The ‘defaultLanguage’ property in Settings and ‘language’ property accept only decimal numbers. The valid values for these properties can be found in the Default Input Locales table.

USB redirection forwards locally attached USB devices to the remote Windows session (MS-RDPEUSB), where they appear as if plugged directly into the remote computer. It uses the browser's WebUSB API, so a device can only be redirected after the app has been granted access to it — either by an enterprise policy or by the user approving it in a device picker.

Note: Devices that are claimed by a ChromeOS system driver (e.g. keyboards, mice, mass storage) generally cannot be redirected; use the dedicated redirection features (drive, smart card, camera, printer) for such devices.

Enabling USB redirection on the remote computer

USB (Plug and Play) device redirection is not allowed by default on the Windows RDP host and must be explicitly enabled through Group Policy:

1. On the remote computer, open the Local Group Policy Editor (gpedit.msc) — or, in a domain, edit a Group Policy Object applied to the host in the Group Policy Management Console.
2. Navigate to Computer Configuration → Administrative Templates → Windows Components → Remote Desktop Services → Remote Desktop Session Host → Device and Resource Redirection.
3. Set Do not allow supported Plug and Play device redirection to Disabled. Leaving the setting Not Configured is not sufficient — it must be explicitly set to Disabled to allow the redirection.
4. Apply the change with gpupdate /force and restart the remote computer (or at least start a fresh remote session).

Redirected devices install on the host using standard Windows drivers; the account's session must be able to install the device's driver (in-box or pre-installed drivers are recommended).

Enabling USB redirection for a connection

Edit the connection and, on the Resources tab, tick USB redirection. All USB devices the app has been granted access to are redirected when the connection starts.

When the checkbox is ticked, the Additional devices table becomes available. Each row identifies a device model by its Vendor ID and Product ID (4-digit hexadecimal, e.g. 045e / 0779) and a mode:

• Include — if no matching device has been granted yet, the app shows a device picker when you press Connect, asking you to approve the device (one prompt per row).
• Exclude — matching devices are never redirected, even if the app has been granted access to them by policy.

Exclusion takes precedence: a device that matches both an include and an exclude row is not redirected and not prompted for.

Note: When devices are specified through the Additional devices table or a .rdp file (rather than through the WebUsbAllowDevicesForUrls policy), access is requested for only one device of each Vendor ID/Product ID combination — the one the user selects in the picker. If several identical devices are attached and all of them must be redirected, provision them through the WebUsbAllowDevicesForUrls policy, which grants access to every matching device.

Provisioning devices with the WebUsbAllowDevicesForUrls policy

For managed ChromeOS devices, grant the app permanent access to specific USB devices through the Google Admin console, so users are never prompted and devices resume automatically after being unplugged:

1. Sign in to the Google Admin console.
2. Go to Devices → Chrome → Settings → Users & browsers.
3. On the left, select the organizational unit containing the users the setting should apply to.
4. Scroll to the Hardware section (or type WebUSB in the search box) and open the WebUSB API allowed devices setting.
5. In the USB device identifiers box, enter one device per line as a colon-separated vendor and product ID pair in hexadecimal, for example:

   045e:0779
   0403:6001

   To allow all devices of a vendor, enter the vendor ID followed by a colon only (e.g. 045e:).

6. In the URL patterns box, enter the app's origin on its own line:

   isolated-app://q2oy25prsvhmxocjxs2badhyi3uw7vqhrupfn66iflserug4st6qaaic

7. Click Save.

The setting takes effect the next time the app is restarted on the managed device.

Automatic .rdp file configuration (usbdevicestoredirect)

When a connection is created from a .rdp file, the standard usbdevicestoredirect property is honored:

• If the property is present and non-empty, USB redirection is enabled for the connection.
• USBInstanceID entries containing a VID_xxxx&PID_xxxx pattern (e.g. USB\VID_045E&PID_0779\6&2c9a8d22&0&6) are added to Additional devices as Include rows; -USBInstanceID entries are added as Exclude rows. Only the VID/PID portion of the instance ID is used — individual device instances cannot be distinguished.
• The wildcard (*) and Device Setup Class GUID () entries only enable the feature; they do not add rows to the Additional devices table.

JSON configuration (managed app configuration)

In the app's managed configuration (Connections policy), each connection object supports the boolean key usbRedirectionEnabled. It overrides the value derived from the usbdevicestoredirect property of the connection's dotRdpFileContent:

Unplugging and reconnecting devices

When a redirected device is unplugged (or resets itself), it is removed from the remote session and a notification is shown. When it is plugged back in, the app re-announces it to the remote session automatically if the app still has access to it:

• Devices provisioned through the WebUsbAllowDevicesForUrls policy resume automatically on reconnect.
• Devices that were manually approved in the device picker generally lose their grant when unplugged (Chrome revokes the permission for devices that do not expose a serial number). Such devices are not re-announced on physical reconnect — disconnect and reconnect the remote session to be prompted again.

For reliable operation of devices that are frequently unplugged or that re-enumerate themselves, provision them through the policy.