Remote Desktop Services on Google Cloud: Secure RDS + RD Gateway Setup

Why RDS on Google Cloud beats physical desktops

A hundred physical PCs means a hundred machines to license, patch, repair, and secure. Remote Desktop Services on GCP replaces all of them with Session Hosts running a golden image — patched once, delivered everywhere.

The architecture

For a 100+ employee real estate company, we built:

1. Session Hosts — Windows Server with the golden image: AutoCAD, softphone (Zoiper), Microsoft Office, Chrome
2. Connection Broker — routes users to the right session host
3. RD Gateway — secure HTTPS access from anywhere, no VPN
4. MFA — every remote login requires multi-factor authentication
5. File servers — quotas and versioning so brokers stop losing documents

Why RD Gateway instead of VPN

VPNs are friction: users forget clients, connections drop, and support calls pile up. RD Gateway exposes a single HTTPS endpoint:

• Works from office, home, or site
• No VPN client to install or troubleshoot
• MFA enforced at the gateway
• URL filtering blocks WhatsApp Web and social media on the work desktop

Group Policy for app control

Personal apps on work desktops slow everything down. Group Policy + URL filtering on the golden image means:

• WhatsApp Web and social media simply don't run
• The same golden image is delivered to every pool
• Users get a fast, predictable desktop

The three-tier power plan (the cost hero)

Because desktops now live on VMs, we could control when they run:

• 24×7: Domain controllers, RD Gateway, file servers
• 9–6 Mon–Sat: office session hosts (native GCP Instance Schedules)
• On-demand: CAD hosts — started on request, auto-off after 15 minutes idle

Result: ~40% compute cost reduction. Zero physical PCs to maintain.

📘 Read the full case study book with architecture diagram

Moving your desktops to the cloud? WhatsApp +91 93197 07938 or contact@krizia.in.