---
title: Managerial Approval for RDP Proxy Connections
slug: kronpam-reference-guide-3-9-0/managerial-approval-for-rdp-proxy-connections
description: Learn how to limit a privileged user's RDP connections to target devices by implementing a managerial approval requirement. Set the "approvalRequiredForConnection" property to "true" on the device group, and an approval email will be sent to the user's gr
docTags: 
createdAt: 2022-07-27T14:28:18.000Z
---

Privileged users’ RDP connections to target devices can be subjected to managerial approvals before establishing the connection. 

To enable managerial requests and approval via email for users connecting to devices, the** Require Managerial Approval** property must be set as **true** on the device group with the target devices.

Refer to the [Managerial Approval for Connections ](docId\:Ogm5XyIsRUXSdVIoy0KW9)section for additional details.

To configure Managerial Approval for RDP connections:

1. Navigate to  **Devices > Inventory > Device Groups.**
2. Select the device group and select the **Connection Approval Methods **option.
3. Set** Require Managerial Approval** as **true.**

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/2Aj_PKezaxy2ZoPsmD5hE_image.png)

When the Managerial Approval feature for a user is enabled, an approval request email is sent to the group manager. For each attempt, a new approval email is generated and sent to the manager.

A parameter can be configured to limit the amount of emails sent to the manager, for each repeated connection attempt. For example, let‘s assume this parameter is set to** 300** seconds and a user attempts to connect a device more than one time in five minutes - only one email approval request will be sent to the manager. If you would like to have only one email to be sent for each connection attempt, the default value of this parameter (”0”) can be used.

1. Navigate to** Administration > System Config. Man. > Add New System Parameter.**
2. Add the parameter below:
   **aioc.approval.email.timeout = 0**  (default value is “0” and the value label is in seconds)
3. After the parameters are set, restart pam- by establishing an SSH connection to the Kron PAM server and running the command:
   **systemctl restart pam-gui**