---
title: Desktop Access Configuration Reference
description: Configuration reference for Teleport Desktop Access.
---

# Windows Desktop Service configuration

`teleport.yaml` fields related to Desktop Access:

```yaml
# Main service responsible for Desktop Access.
#
# You can have multiple Desktop Access services in your cluster (but not in the
# same teleport.yaml), connected to the same or different Active Directory
# domains.
(!docs/pages/includes/config-reference/desktop-config.yaml!)
```

## Deployment

The Windows Desktop Service can be deployed in two modes.

### Direct mode

In *direct* mode, Windows Desktop Services registers directly with the Teleport
Auth Server, and listens for desktop connections from the Teleport Proxy. To
enable direct mode, set `windows_desktop_service.listen_addr` in
`teleport.yaml`, and ensure that `teleport.auth_server` points directly at the
Auth Server. Direct mode requires network connectivity from the Teleport Proxy
to Windows Desktop Service, and from Windows Desktop Service to the Auth Server.

### IoT mode (reverse tunnel)

In *IoT mode*, Windows Desktop Service only needs to be able to make an outbound
connection to a Teleport Proxy. The Windows Desktop Service establishes a
reverse tunnel to the proxy, and both registration with the Auth Server and
desktop sessions are performed over this tunnel. To enable this mode, ensure
that `windows_desktop_service.listen_addr` is *unset*, and point
`teleport.proxy_server` at a Teleport Proxy.