Skip to content

Scenario 2 — Existing gateway (static servers)

Builds on a client gateway already connected to the cluster and adds non-domain Windows servers (not joined to AD) to it as static hosts, then waits for them to show up in Teleport. No gateway reinstallation.

When to use it

  • The Linux gateway already exists (scenario 1 already done for this client).
  • You want to expose non-domain servers (workgroup) or machines not covered by AD discovery.

Prerequisites

  • A windows_desktop gateway already connected (visible in the inventory).
  • The target servers reachable over RDP (3389) from the gateway.
  • The application deployed and reachable.

Steps in the wizard

  1. Choose "Add servers to an existing proxy".
  2. Select the already connected client gateway (identified by its labels).
  3. Add each static server: name (the Teleport desktop name), address (IP or DNS name reachable by the gateway), RDP port (3389 by default).
  4. The wizard merges these hosts into the gateway configuration and waits for them to register.

Points of attention

  • Since these hosts are non-domain, access relies on each machine's RDP configuration (the Teleport certificate must be trusted on the host side for certificate authentication, or use the appropriate mode according to your policy).
  • NLA may need an adjustment on the host side depending on the Teleport version.

Verification

tctl desktop ls          # the new static hosts should appear

The app's guided phase lists the desktops reported for the client and flags any expected hosts that are missing.

Checklist

  • [ ] The static hosts are listed in the guided phase (or tctl desktop ls).
  • [ ] No join token to revoke: this scenario reuses the gateway's existing identity and creates no token. See Error codes & Debugging.