If you need to provide access to a GUI / GUIs in one network from within another network, can RDP (e.g. via Terminal Services) be used as an effective security 'barrier', to stop any other direct network connectivity between the two environments. I know it's possible to transfer files in either direction via RDP, but I'm assuming it also possible to disable this via policy on one side or the other?

Any other risks with this approach, or similar (E.g. VNC type interfaces)? I assume they all have their vulnerabilities but am trying to avoid an environment with 2 machines on every desktop.

1 Answer 1


RDP stands for "Remote Desktop Protocol", so what it provides to people who connect is a full fledged session on the server. By default, this gives these people the same kind of power that they could have by sitting in front of the machine (except that they won't be able to attack the machine "physically").

If you want to prevent users from, e.g., uploading arbitrary executable files to the RDP server and running them from the server, then you have to restrict the Windows session down by deactivating right-click on most items, removing most or all of the "Start menu" entries, preventing copy&paste of files through RDP, and generally speaking nerf it down. All of this can be down through Group Policy Objects pushed from the Active Directory server. However, there are a lot of details to think about, and since this is a blacklist-like activity, it is difficult to know if you thought of everything (for instance, if you want to allow users to connect to a second server through Internet Explorer but do not wish them to access the configuration menus of IE, remember that the "Alt" key can make these menus reappear, if you just "hide" them). As a general rule, I would advise against using an intermediate RDP server as the foundation for your security; you'd better treat the RDP machine as "potentially hostile".

The security situation is similar with VNC, since it exports a desktop. The comparison between RDP and VNC will be mostly over performance and integration (if using a Windows server, RDP will be easier to setup for multiple concurrent clients, and will offer better performance over slow networks; for Linux systems, consider FreeNX).

  • 1
    I don't want to post as another answer since I think Thomas hit it on the head, but just to be direct. Using RDP is effectively going to be the same as if you put a second desktop on each person's computer as long as you are running Terminal Services. (The difference being that they run on a common OS, so user isolation is tricky.) Another popular approach is to use something like VMWare View which gives better isolation for users (as each can have their own virtual desktop) but also is a little bit more resource intensive (since each user has their own running instance of Windows). Commented Feb 19, 2013 at 14:51
  • I agree with the above comments. In addition however, if your concerned about security. You might want to consider investing (a lot of money) in Citrix which also provides remote desktop functionality, however, it allows for extensive controls over the user environemnt. Additionally. You secure RDP sessions using things like 2 factor authentication (RSA tokens), SSL Certificates and NLA and configuring the remote computer to have further restrictions around what remote users can do/access.
    – NULLZ
    Commented Feb 20, 2013 at 1:34
  • Comparison of RDP vs. VNC also brings up authentication mechanisms. Last I checked VNC only allowed single-password login with no audit trail. It also allows viewing and control of active sessions.
    – Iszi
    Commented Feb 20, 2013 at 1:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .