I have Windows 2008 R2 servers which are failing a PCI vulnerability scan because they have RDP enabled (needs to be disabled).
I have applied the PCI settings of IISCrypto tool, but I have to leave TLS 1.0 enabled in order not to break RDP. The only "solution" I have been able to find is to not use TLS, but that makes little sense since legacy RDP Security Layer is less secure.
Another site suggested turning off all cipher suites that use CBC, but doing that broke RDP for me. I have also tried other suggested cipher settings, to no avail (also broke RDP).
This post seems to indicate that BEAST is not really an issue for RDP.
Can the BEAST vulnerability really be used to compromise RDP? Are there any exploits / has it ever been done?