[Yandex Cloud documentation](../index.md) > [Yandex Cloud Desktop](index.md) > Getting started > For admins

# Getting started with Yandex Cloud Desktop for administrators

{% note info %}

Follow this guide to create and set up a [desktop group](concepts/desktops-and-groups.md). If you received a link to the [user desktop showcase](concepts/showcase.md) from an administrator, go to [Getting started with Yandex Cloud Desktop for users](quickstart-users.md).

{% endnote %}

Cloud Desktop is a virtual desktop infrastructure management service.

Create a Yandex Identity Hub [user group](../organization/concepts/groups.md) and deploy a Cloud Desktop [desktop group](concepts/desktops-and-groups.md) for it:

1. [Get your cloud ready](#before-you-begin).
1. [Create a user group](#create-user-group).
1. [Deploy a desktop group](#create-desktop-group).
1. [Configure an ACL for the desktop group](#setup-acl).
1. [Create a desktop](#create-desktop).
1. [Get the connection credentials](#get-credentials).
1. [Connect to the desktop](#connect-desktop).

## Getting started {#before-you-begin}

1. Log in to the [management console](https://console.yandex.cloud) or sign up. If not signed up yet, navigate to the management console and follow the on-screen instructions.
1. On the [**Yandex Cloud Billing**](https://center.yandex.cloud/billing/accounts) page, make sure you have a [billing account](../billing/concepts/billing-account.md) linked and its status is `ACTIVE` or `TRIAL_ACTIVE`. If you do not have a billing account yet, [create one](../billing/quickstart/index.md#create_billing_account).
1. If you do not have a folder yet, [create one](../resource-manager/operations/folder/create.md).
1. [Assign](../iam/operations/roles/grant.md) these _minimum_ roles to your Yandex Cloud account:
    * [organization-manager.admin](../organization/security/index.md#organization-manager-admin) for the [cloud](../resource-manager/concepts/resources-hierarchy.md#cloud): To create a user group.
    * [vdi.admin](security/index.md#vdi-admin) for the [folder](../resource-manager/concepts/resources-hierarchy.md#folder): To create a desktop group and assign an [ACL](concepts/acl.md) to it.

    If you have a primitive [admin](../iam/roles-reference.md#admin) role for a folder, you do not need to assign any additional roles.

    {% note info %}
    
    If you cannot manage roles, contact your cloud or organization administrator.
    
    {% endnote %}

1. To make sure your desktops have access to the internet, [set up](../vpc/operations/create-nat-gateway.md) a NAT gateway for the [subnets](../vpc/concepts/network.md#subnet) that will host them.

## Create a user group {#create-user-group}

{% list tabs group=instructions %}

- Cloud Center interface {#cloud-center}

  1. Log in to [Yandex Identity Hub](https://center.yandex.cloud/organization) using an administrator or organization owner account.

  1. In the left-hand panel, select ![groups](../_assets/console-icons/persons.svg) **Groups**.

  1. In the top-right corner of the page, click ![Circles3Plus](../_assets/console-icons/circles-3-plus.svg) **Create group**.

  1. Enter a name and description for the [group](../organization/concepts/groups.md).

      The name must be unique within the [organization](../overview/roles-and-resources.md) and follow the naming requirements:

      * It must be from 1 to 63 characters long.
      * It may contain lowercase Latin letters, numbers, and hyphens.
      * It must start with a letter and cannot end with a hyphen.

  1. Click **Create group**.

  1. On the page that opens, go to the **Members** tab and click **Add member**.

  1. In the window than opens, select the users to deploy a desktop group for.

  1. Click **Save**.

{% endlist %}

## Deploy a desktop group {#create-desktop-group}

Follow this guide to create a desktop group based on pre-installed `Ubuntu 20.04 LTS`. Also, you can:

* [Creating an image from a Compute Cloud Linux instance](operations/images/create-from-compute-linux.md)
* [Create a Windows-based image](operations/images/create-from-windows.md)

{% list tabs group=instructions %}

- Management console {#console}

  1. In the [management console](https://console.yandex.cloud), select the folder where you want to create your desktop group.
  1. Navigate to **Cloud Desktop**.
  1. Click **Create desktop group**.
  1. Enter a name for the desktop group.
  1. Select **Group type**: **Personal**. Desktops are assigned to users on their first sign-in and remain reserved for them.
  1. Under **Desktops**, specify:
     1. **Maximum desktop group size**: `2`, maximum number of desktops per group.
     1. **Hot standby**: `1`, number of desktops kept always loaded for quick user access.
  1. Under **Computing resources** on the **Standard** tab, click **Basic**.
  1. Select `Ubuntu 20.04 LTS` for the OS [image](concepts/images.md).
  1. Under **Disks**:
      * Select the boot and data [disk](concepts/disks.md) [types](../compute/concepts/disk.md#disks-types): `SSD`.
      * Set the boot disk size to `60 GB`.
      * Set the data disk size to `4 GB`.
  1. Under **Network settings**, select the [cloud network](../vpc/concepts/network.md#network) and [subnets](../vpc/concepts/network.md#subnet) where your desktops will reside.
  1. Under **Desktop users**, click **Add users** and specify those the desktops will be available to:
     * [User groups](../iam/concepts/access-control/public-group.md).
     * [Individual users](../iam/concepts/users/accounts.md).
     * Any user's mail address. The user will be sent an invitation to your organization and assigned a role for desktop access.
  1. Click **Create**.

{% endlist %}

## Configure an ACL for the desktop group {#setup-acl}

Cloud Desktop leverages [Yandex Identity and Access Management roles](security/index.md) and [access control lists (ACL)](concepts/acl.md) to manage access. [This example](concepts/acl.md#example) shows how access control works in Cloud Desktop.

{% list tabs group=instructions %}

- Management console {#console}

  1. In the list of desktop groups, select the group you created earlier.
  1. In the left-hand panel, select ![persons](../_assets/console-icons/persons.svg) **Access permissions**.
  1. Click **Assign roles**.
  1. In the **Granting access** window that opens, select the user group you created earlier.
  1. Click **Add role** and specify the `vdi.desktopGroups.user` [role](security/index.md#vdi-desktopGroups-user) or `vdi.desktopGroups.maintainer` [role](security/index.md#vdi-desktopGroups-maintainer).
  1. Click **Save**.

{% endlist %}

## Create a desktop {#create-desktop}

{% list tabs group=instructions %}

- Management console {#console}

  1. In the left-hand panel, select ![image](../_assets/console-icons/display.svg) **Desktops**.
  1. Click **Create desktop**.
  1. Select the desktop group you created earlier.
  1. Specify the subnet for the desktop.

      {% note info %}

      Make sure to [configure a NAT gateway](../vpc/operations/create-nat-gateway.md) in this subnet, so your desktop will have internet access.

      {% endnote %}

  1. Specify the desktop user.
  1. Click **Create**.

{% endlist %}

## Get the connection credentials {#get-credentials}

{% list tabs group=instructions %}

- Management console {#console}

  1. In the [management console](https://console.yandex.cloud), select the folder containing your desktop.
  1. Navigate to **Cloud Desktop**.
  1. In the left-hand panel, select ![image](../_assets/console-icons/display.svg) **Desktops**.
  1. Select the desktop you want to connect to.
  1. Under **Desktop user**, next to the user account, click ![image](../_assets/console-icons/ellipsis.svg) and select **Reset password**.
  1. Confirm the password reset.
  1. Save the new password from the pop-up window that appears and close the window.
  1. At the top right, click ![image](../_assets/console-icons/arrow-down-to-line.svg) **Download RDP file**.

- User desktop showcase {#desktop-showcase}

  1. Open the [User desktop showcase](https://console.yandex.cloud/showcase/cloud-desktop).
  1. Sign in with your [Yandex ID](https://yandex.com/support/id/index.html) or using [Single Sign-On (SSO)](../organization/concepts/add-federation.md).
  1. If the desktop you want to connect to has the `Stopped` status, run it by clicking ![image](../_assets/console-icons/play.svg) and then confirming the action.
  
      Wait for the desktop status to change to `Active`.
  1. Click ![image](../_assets/console-icons/lock-open.svg) and confirm the password reset.
  1. Save the new password from the pop-up window that appears, then close the window.
  1. Click ![image](../_assets/console-icons/arrow-down-to-line.svg) **Download RDP file**.

- Yandex Cloud CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../cli/quickstart.md#install).

  The folder used by default is the one specified when [creating](../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  1. See the description of the [CLI](../cli/index.md) command for getting RDP file data:

      ```bash
      yc desktops desktop get-rdp-file --help
      ```

  1. Get a list of desktops in the default folder:

      ```bash
      yc desktops desktop list
      ```

      Result:

      ```bash
      +----------------------+------------------+--------+----------------------+---------------------+
      |          ID          |       NAME       | STATUS |   DESKTOP GROUP ID   |   CREATED (UTC-0)   |
      +----------------------+------------------+--------+----------------------+---------------------+
      | e3vmvhgbgac4******** | my-cloud-desktop | ACTIVE | e3v1rbln45tl******** | 2024-10-09 22:42:28 |
      | e3vio1bc5ppz******** | reserved-desktop | ACTIVE | e3v1rbln45tl******** | 2024-10-09 21:35:17 |
      +----------------------+------------------+--------+----------------------+---------------------+
      ```

  1. Select the `ID` or `NAME` of the desktop you need, e.g., `my-cloud-desktop`.
  1. [Reset](operations/desktops/password-reset.md) the desktop user password.


  1. Request the data:

      ```bash
      yc desktops desktop get-rdp-file --name <desktop_name>
      ```

      Result:

      ```text
      full address:s:my-cloud-desktop
      gatewayhostname:s:rdg.vdi.cloud.yandex.net:3839
      gatewaycredentialssource:i:5
      gatewayusagemethod:i:1
      gatewayprofileusagemethod:i:1
      gatewayaccesstoken:s:ver=1;desktopUserToken=0174a9f2-...V6DQ
      networkautodetect:i:0
      bandwidthautodetect:i:1
      connection type:i:6
      username:s:.\alice-little
      domain:s:
      bitmapcachesize:i:32000
      smart sizing:i:1
      audiocapturemode:i:1
      audiomode:i:0
      authentication level:i:0
      ```

  1. Save the received data to an `.rdp` file.

- API {#api}

  Use the [getRdpFile](api-ref/Desktop/getRdpFile.md) REST API method for the [Desktop](api-ref/Desktop/index.md) resource or the [DesktopService/GetRdpFile](api-ref/grpc/Desktop/getRdpFile.md) gRPC API call.

  To reset the password, use the [resetPassword](api-ref/Desktop/resetPassword.md) REST API method for the [Desktop](api-ref/Desktop/index.md) resource or the [DesktopService/ResetPassword](api-ref/grpc/Desktop/resetPassword.md) gRPC API call.

{% endlist %}

## Connect to the desktop {#connect-desktop}

To establish a desktop connection, use the [Remote Desktop Protocol](https://en.wikipedia.org/wiki/Remote_Desktop_Protocol) (RDP).

{% note info %}

* Use the desktop user password. This password is not the same as your Yandex account password. If you do not know your password, [get a new one](operations/desktops/password-reset.md).
* The login is filled automatically from the RDP file. If you need to enter it manually, specify your email without the domain, e.g., `user` instead of `user@example.com`.

{% endnote %}

{% list tabs group=operating_system %}

- Windows {#windows}

  1. Right-click the downloaded RDP file and select **Edit** (in Windows 11, select **Show more options** → **Edit**).
  1. In the **Remote Desktop Connection** window, open the **General** tab, select **Allow me to save credentials**, and click **Connect**.
  1. In the security window that opens, select **Don't ask me again for connections to this computer** and click **Yes**.
  1. Enter the password you saved previously, select **Remember me**, and click **OK**.

  To reconnect to the desktop, run the RDP file you saved.

- macOS {#macos}

  1. Install and run [Microsoft Remote Desktop](https://itunes.apple.com/ru/app/microsoft-remote-desktop/id1295203466), the official free RDP client for macOS.
  1. Open the **Connections** menu amd click **Import from RDP file**.
  1. In the window that opens, select the downloaded RDP file and click **Import**.
  1. In the **Microsoft Remote Desktop** menu, select **Settings**.
  1. In the window that opens, navigate to the **User Accounts** tab.
  1. Select the account you want to connect to from the list on the left, and paste the previously saved password into the **Password** field.
  1. Close the settings window.
  1. In the **PCs** tab, run the desktop you added.
  1. In the security window that opens, click **Continue**.

  To reconnect to the desktop, run it from the **PCs** tab in the Microsoft Remote Desktop client. In the security window that opens, click **Continue**.

  #### Useful links {#mac-see-also}

  * [Getting started with a remote desktop in macOS](https://docs.microsoft.com/en-us/windows-server/remote/remote-desktop-services/clients/remote-desktop-mac)

- Linux {#linux}

  1. Install [Remmina](https://remmina.org), a free RDP client for Linux, by running the following commands in the terminal:

      ```bash
      sudo apt-add-repository ppa:remmina-ppa-team/remmina-next
      sudo apt-get update
      sudo apt-get install remmina remmina-plugin-rdp
      ```

  1. Start Remmina.
  1. In the top menu, click ![image](../_assets/console-icons/bars.svg) and select **Import**. Select the downloaded RDP file and click **Import**.
  1. Right-click the added desktop and select **Edit**.
  1. In the **Remote Connection Profile** window, set up the connection:

     * In the **Username** field, remove the first two characters: `.\`.
     * In the **Password** field, enter the previously saved password.
  1. Click **Save and Connect**.

  To reconnect to the desktop, run it in the Remmina client.

  #### Useful links {#lin-see-also}

  * [Installing Remmina on non-Ubuntu Linux distributions](https://remmina.org/how-to-install-remmina/)

{% endlist %}