KB4570006: Update to disable and remove the RemoteFX vGPU component in Windows

Overview

RemoteFX vGPU makes it possible for multiple virtual machines to share a physical GPU. This feature was introduced in Windows 7 and was removed as an option for users in Windows Server 2019. We are now aware that the current implementation of RemoteFX vGPU appears susceptible to security vulnerabilities (see the FAQ section for CVE details). Because these newly identified vulnerabilities are architectural, and the feature is already removed from newer versions of Windows, the April 13, 2021 Windows Security Updates and all superseding Windows Updates will no longer contain the RemoteFX vGPU feature.

We strongly encourage that you seek an alternative vGPU option.

Timeline

Deprecation: RemoteFX vGPU was removed with the release of Windows 10, version 1809 and Windows Server 2019.

Disablement: RemoteFX vGPU was disabled in all applicable Windows platforms in the July 2020 Windows security updates (July 14, 2020).

Removal: RemoteFX vGPU will be removed from all applicable Windows platforms in the April 2021 Windows security updates (April 13, 2021)

Alternatives

To mitigate potential security risks within RemoteFX vGPU, we strongly recommend that users consider using an alternative vGPU technology.

Secure GPU virtualization is available through Discrete Device Assignment (DDA) in Windows Server LTSC releases (Windows Server 2016, Windows Server 2019) and Windows Server SAC releases (Windows Server, version 1803 and later versions).

Frequently asked questions

We will no longer release security or nonsecurity updates for RemoteFX vGPU.

If you have a RemoteFX vGPU adapter associated with your VM before installing the April 13, 2021 Security Update, you will need to remove the vGPU adapter before re-starting the VM.

Secure GPU virtualization is available through Discrete Device Assignment (DDA) in Windows Server LTSC releases (Windows Server 2016 and Windows Server 2019) and Windows Server SAC releases (Windows Server, version 1803 and later versions). If you are on a Windows version earlier than Windows 10, version 1607, please consider upgrading.

Please refer to the following security updates for more information:

KB4570006: обновление для отключения и удаления компонента VGPU RemoteFX в Windows

Обзор

С помощью VGPU remoteFX можно совместно работать с несколькими виртуальными машиными. Эта функция впервые была представлена в Windows 7 и удалена в качестве параметра для пользователей в Windows Server 2019. Мы знаем, что текущая реализация удаленного VGPU является уязвимой к уязвимостям системы безопасности (подробные сведения о CVE см. в разделе «Часто задаваемые действия»). Поскольку новые уязвимости являются архитектурными, а функция уже удалена из более новых версий Windows, обновления безопасности Windows от 13 апреля 2021 г. и все новые версии Windows больше не будут содержать функцию RemoteFX vGPU.

Мы настоятельно рекомендуем вам выбрать альтернативный вариант VGPU.

Временная шкала

Деprecation: RemoteFX vGPU был удален с выпуском Windows 10 версии 1809 и Windows Server 2019.

Отключение: В обновлениях безопасности Windows за июль 2020 г. (14 июля 2020 г.) на всех соответствующих платформах Windows был отключен VGPU RemoteFX.

Удаление: В обновлении для системы безопасности Windows за апрель 2021 г. (13 апреля 2021 г.) будет удален VGPU RemoteFX со всех соответствующих платформ Windows.

Альтернативы

Чтобы снизить потенциальные угрозы безопасности в VGPU RemoteFX, настоятельно рекомендуем пользователям использовать альтернативную технологию VGPU.

Безопасная виртуализация GPU доступна с помощью дискретного назначения устройств (DDA) в выпусках LTSC Windows Server (Windows Server 2016, Windows Server 2019) и SAC Windows Server (Windows Server версии 1803 и более поздних версий).

Вопросы и ответы

Мы больше не будем выпускать обновления для системы безопасности и другие обновления для удаленного VGPU.

Если перед установкой обновления для системы безопасности от 13 апреля 2021 г. с VM связан адаптер VGPU, необходимо удалить его перед повторной запуском VM.

Безопасная виртуализация GPU доступна с помощью дискретного назначения устройств (DDA) в выпусках LTSC Windows Server (Windows Server 2016 и Windows Server 2019) и SAC Windows Server (Windows Server версии 1803 и более поздних версий). Если вы находитесь на более ранней версии Windows, чем Windows 10 версии 1607, рассмотрите возможность обновления.

Дополнительные сведения можно найти в следующих обновлениях для системы безопасности:

Remotefx warning windows 10

This forum has migrated to Microsoft Q&A. Visit Microsoft Q&A to post new questions.

Asked by:

Question

Hyper-V — Server 2016 Desktop Virtualization Host with all available updates as of 09/12/2019
-nVidia Tesla M10 with newest Graphics Drivers available — fully support 1903
-Registry setting for AVC444ModePreferred = 1
-Registry setting for AVCHardwareEncodePreferred = 2

VDI Desktop — Windows 10 1903 with all available updates installed as of 09/12/2019
-RemoteFX Adapter added to VM with 2x monitors with 512MB

RDP Client Endpoint — Win10 1803, Win10 1809, Win10 1903 all with all available updates as of 09/12/2019

Scenario 1: RDP from client to the VDI through RDCB or directly: Fails to connect with administrator message

Scenario 2: Connect to VM through Hyper-V Console with RemoteFX enabled — Works flawlessly

Scenario 3: Enable the ‘Use WDDM graphics display driver for Remote Desktop Connections’ policy — Connection works over RDP but it appears RemoteFX isn’t functioning fully as graphics are sluggish. This should not be the fix as the nVidia RemoteFX drivers should be fully WDDM compatible.

Scenario 4: Remove RemoteFX Adapter — Connection works over RDP but is sluggish due to no RemoteFX

This person is having the same problem but the fixes are not working for me and since he did not respond, I’m not sure the fixes are actually working — https://social.technet.microsoft.com/Forums/office/en-US/25fa7511-c21d-44e7-9c5f-b77ffdd4d2ac/remotefx-on-hyperv-console-but-not-through-rdp?forum=winserverTS

Message Received on RDP Client:

Your Remote Desktop Services session has ended, possibly for one of the following reasons:
The administrator has ended the session.
An error occurred while the connection was being established.
A network problem occurred.

More to come — Working on adding additional details

Remotefx warning windows 10

This forum has migrated to Microsoft Q&A. Visit Microsoft Q&A to post new questions.

Asked by:

Question

As we don’t have gpedit.msc on Windows 10 HOME edition, how can we enable RemoteFX in order to use USB devices when connecting to an RDP server? Maybe editing a registry key. if yes .. which one?

All replies

From this case below, we can see that:

HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\Client

With a value of fUsbRedirectionEnableMode. If you set this to 2, that should be the same as enabling the policy.

However, RemoteFX vGPU requirements:

Windows Server 2016 or Windows 10

DX 11.0 compatible GPU with WDDM 1.2 compatible driver

Windows Server RD Virtualization Host role enabled (enables Hyper-V Role)

Server with a CPU that supports SLAT (Second Level Address Translation)

However, we cannot enable Hyper-V in Home edition, this feature only be supported on Pro and Enterprise/Education edition.

Remotefx warning windows 10

Вопрос

As we don’t have gpedit.msc on Windows 10 HOME edition, how can we enable RemoteFX in order to use USB devices when connecting to an RDP server? Maybe editing a registry key. if yes .. which one?

Все ответы

From this case below, we can see that:

HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\Client

With a value of fUsbRedirectionEnableMode. If you set this to 2, that should be the same as enabling the policy.

However, RemoteFX vGPU requirements:

Windows Server 2016 or Windows 10

DX 11.0 compatible GPU with WDDM 1.2 compatible driver

Windows Server RD Virtualization Host role enabled (enables Hyper-V Role)

Server with a CPU that supports SLAT (Second Level Address Translation)

However, we cannot enable Hyper-V in Home edition, this feature only be supported on Pro and Enterprise/Education edition.