After the recent critical vulnerability: 'MS12-020: Vulnerabilities in Remote Desktop could allow remote code execution' I have been looking for a hardening checklist or in the scenario that I am an admin at an organization which allows access by Remote Desktop, what would be reasons to disable it or how to implement it securely, apart from Transport Layer security?

1 Answer 1


Defense-in-depth, patching policy, audit lots, and the standard security spiel are a good starting point. The risk isn't that there was a critical vulnerability as much as it is having mechanisms to prevent or detect unauthorized access. There are vulnerabilities that are known and exploited well before a tracking code (MS, CVE, BugTraq) are assigned.

The Center for Internet Security publishes hardening checklists for various devices. There are likely other organizations that publish similar checklists too.

You can easily disable RDP, but that may not necessarily increase your security posture (say if you're running a vulnerable/unpatched version of IIS with a publicly available exploit package). Protecting against 0day is a bit tougher, but there are ways to detect intrusion and prevent data exfiltration.

  • Would love to hear more about what exactly "defense-in-depth, patching policy, audit lots, and the standard security spiel" entails specifically as applied to securing Remote Desktop. Which is a nice way of saying this answer leaves a lot of unanswered questions, for me at least.
    – Pat James
    Commented Feb 4, 2013 at 19:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .