0

What are the security risks of allowing the Remote desktop connection to be enabled on machines within an organisation?

From reading various blogs on the subject, I can stop the use of the MSTSC.exe command, but I am wondering what the benefit of it would be.

2

RDP is as easy protocol to scan for, and thus attempt a brute force login, especially if you still use the default user accounts on Windows PCs. Never expose RDP externally for that reason.

That said, we still enable it internally for providing remote support to users. Make sure you lock down the users that can use it internally via the local Remote Desktop Users group on the workstations. You can do this through: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Allow Log on through Remote Desktop Services

If you do want to disable it, you'd be better off disabling it via group policy (Computer Configuration\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Connections\Allow users to connect remotely using Remote Desktop Services) and/or blocking port 3389 on the client firewall, rather than trying to stop the execution of mstsc.exe.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.