Remote work, the network admin connecting from home, or the accounting software vendor’s support connection: the quick fix for all of these has often been to open the Remote Desktop (RDP) port on the firewall to the internet. That simple shortcut is one of the most common ways ransomware gets into companies.
Why Is Exposed RDP Dangerous?
- Found quickly: Scanning bots constantly sweep the internet address space looking for open RDP. Changing the default port
3389only delays discovery slightly. - Password-guessing attacks: Once found, countless username and password combinations are tried. A single account with a weak or reused password is enough.
- Vulnerabilities: Vulnerabilities such as BlueKeep showed that an unpatched RDP service can be attacked even without a password.
- Direct access to the inside: Whoever gets in is sitting on a system inside your network.
The Right Way: VPN First, Then Remote Desktop
The simplest secure pattern is for the user to connect to the company network with a VPN first, then use Remote Desktop to reach their computer or server through the tunnel. On the firewall, the RDP port is closed to the internet and only allowed from the VPN address range. This pattern has two conditions:
- The VPN must have two-factor authentication; otherwise you have only moved the problem from RDP to the VPN.
- The firewall or VPN server firmware must always be kept up to date.
Option Two: Remote Desktop Gateway
If you have many users or do not want to install a VPN on every device, the Remote Desktop Gateway role in Windows Server carries remote connections over HTTPS on port 443. In this setup only the gateway is exposed to the internet; it uses a valid certificate, can be combined with two-factor authentication, and lets you define which systems each user group can connect to.
Harden RDP Itself
Even behind a VPN, these settings are necessary:
- Keep NLA (Network Level Authentication) enabled so authentication happens before a full session is established.
- Only users who truly need it should be members of the
Remote Desktop Usersgroup. - Enable an account lockout policy after several failed logins.
- Review failed logins (event
4625) and successful remote logins in the logs. - Have idle or disconnected sessions close after a set time.
If you have RDP exposed to the internet today, review the login logs when you close it. A successful login from an unfamiliar address or at an unusual hour may be a sign that an attacker is already inside.
Remote Support Software
Remote support tools are useful for helping users, but if every employee or contractor installs their own, you end up with uncontrolled ways in. Choose one standard tool for the company, enable unattended access only for the systems that need it and with a strong password and two-factor authentication, and restrict the installation of other tools. Also remind staff never to give a connection code to an unknown caller who claims to be “support”.
Contractor Access
A software vendor’s support team or an external contractor should not have permanent, unlimited access. Create a separate account for each contractor, grant access only to the relevant system, and enable the account when needed and disable it once the work is done.
Checklist
- The RDP port is closed to the internet on the firewall.
- Remote access is only through a VPN or RD Gateway with two-factor authentication.
- NLA and an account lockout policy are enabled.
- Membership in the Remote Desktop Users group is limited.
- Only one standard remote support tool is allowed.
- Contractor access is separate and temporary.
ITPlus724 engineers can redesign your company’s remote access with a VPN or RD Gateway and two-factor authentication without disrupting users’ work.