Secure, Reliable Access to a Cloud Windows Server with Remote Desktop

For many companies, working with a cloud Windows Server means Remote Desktop, or RDP: the system administrator connects for maintenance, and staff connect to use finance or office software. RDP is an excellent tool, but an RDP port open to the internet is a constant target for password-guessing bots and ransomware. The good news is that a few simple settings improve both security and the user experience.

Secure ways to connect

Three common methods, from simple to professional:

• IP restriction: The RDP port is open in the firewall only to the office’s static IP. It is simple and effective, but not enough for remote staff with changing IPs.
• Connecting through VPN: The user connects to the VPN first and then to the server, and the RDP port is not exposed to the internet at all. For most companies, this is the best balance between security and simplicity.
• Remote Desktop Gateway: A dedicated Windows Server role that wraps the RDP connection in HTTPS and works with a valid certificate and access policies. It suits larger numbers of users, and two-factor authentication can be added with supplementary tools.

Security settings on the server itself

1. Keep Network Level Authentication (NLA) enabled so authentication happens before the session is fully established.
2. Rename or disable the default Administrator account, and create a separate account for each administrator.
3. Configure an Account Lockout policy so an account is locked for a while after several failed attempts.
4. Add only the users who need it to the Remote Desktop Users group; regular users should not have administrator access.
5. Restrict drive and clipboard redirection as needed. If users should not take files off the server, disable these features with Group Policy.

Strong passwords and account lockout are necessary, but not sufficient. As long as the RDP port is open to the whole internet, your server is under constant attack.

Multiple concurrent users and licensing

By default, Windows Server allows only two concurrent remote sessions for administrative tasks. If several employees need to work on the server at the same time, you must install the Remote Desktop Services role and obtain user access licenses (RDS CALs). Check the licensing details for your Windows Server version and number of users.

A stable, smooth connection

• Disconnect or sign out: Teach users to sign out when they finish. Closing the window only disconnects the session, and their applications stay open on the server.
• Session time limits: Set limits for disconnected and idle sessions to free up server resources, but not so short that a brief internet outage costs users their unfinished work.
• Internet quality: RDP works even on weak internet connections, but it can’t make up for frequent outages. Give the office a stable connection and, if possible, a backup link.
• Display settings: On slow connections, lowering the color depth and disabling visual effects in the connection client noticeably improves speed.
• Printing: Printing from the server to the user’s local printer is usually done through printer redirection in RDP; test the office drivers and printers in advance.

Checklist

• RDP is reachable only from a specific IP, VPN or Gateway.
• NLA is enabled and an account lockout policy is configured.
• The default Administrator account has been renamed or disabled.
• Only the users who need it have remote access.
• The number of concurrent users matches your RDS licenses.
• Time limits for idle and disconnected sessions are configured.

A secure, stable remote connection makes daily work with a cloud server hassle-free. ITPlus724 engineers can set up and optimize VPN, Gateway and Remote Desktop settings for your cloud server.