Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [rdp]

Remote Desktop Protocol, a protocols for accessing Windows applications remotely

1
vote
1answer
85 views

Metasploit MacOS victim - tools to enable remote desktop / GUI view of the victim

If the exploited victim OS is Windows, metasploit has the getgui command to run RDP. Then he can manipulate the victim OS through the GUI desktop interface. meterpreter > run getgui -u loneferret -...
0
votes
0answers
5 views

How to distribute RDP certificates from ADCS to non-domain members? [migrated]

I have a few hundred systems that are not AD-joined, for which I'd like to issue RDP certificates from an internal hierarchy (built with ADCS). I can do it manually, by generating CSRs, then signing ...
6
votes
1answer
836 views

I'm hacked without telling anyone my ip [duplicate]

I have a pc with static IP bought from my ISP and RDP enabled. I was using this PC for development and didn't tell or use it for any communication purpose so it's not possible that someone knew about ...
2
votes
0answers
32 views

Is it possible for a remote machine to “escape” from a folder mapped through RDP?

Although most people seem to share entire drives with RDP, it is possible to share individual folders, by mapping them to a drive for example with subst <lettertomap>: <pathtofolder> (for ...
3
votes
2answers
95 views

RDP violation without credentials

On a Windows Server 2003 machine seems like someone has logged in through RDP without using credentials: there is a logged access, but there are nor userid nor password. I am wondering how is this ...
1
vote
1answer
643 views

Best tool to BruteForcing RDP

I have tried many tools and to do not seem to be successful with locking out an account I am testing on my network with an RDP domain. I used crowbar, ncrack and THC hydra but they don't seem to be ...
0
votes
1answer
537 views

THC Hydra on Windows RDP Domain

I am testing a bruteforce on a windows rdp server within a domain. It seems to not be working because nothing is locking out the account I am targeting. How do you specify a domain username? I tried ...
23
votes
2answers
5k views

What are the risks of remoting in (RDP) to a compromised system? [duplicate]

Can the client be harmed in any way, and how?
-2
votes
2answers
167 views

Accidently watched content against company policy while connected to work using RDP

I was at home and had some work to be finished so I used IE connected remotely to my work PC finished the job but forgot to disconnect. After a while I started watch not-safe-for-work material in ...
5
votes
1answer
137 views

CVE-2018-0886 mitigation for an unpatchable RDP server

An up-to-date Windows 10 client is connecting to a Windows 10 RDP host which is stuck at 1511 (host can't be updated and 1511 is out of support for receiving patches such as the CVE-2018-0886 ...
3
votes
1answer
197 views

Can passwords be brute-forced through RDP?

We had a small discussion about a security-related article at work today, and I was a bit surprised about one thing - they claim that some attackers managed to brute-force guess the password of ...
2
votes
1answer
65 views

Controlling windows server on Amazon Web Services

Our site is ISO-27001 compliant. As part of the compliance we were advised not to use RDP to connect to the server, but rather to choose a cloud server which provides a web-interface. Our current ...
5
votes
2answers
257 views

Is there a way to see what is program is causing RDP attempts on computer

One of our servers (running RdpGuard) shows multiple failed attempts from specific users' machines (3 to be exact) and I can't figure out what is causing them. One user is local and two are remote ...
3
votes
2answers
1k views

Is open RDP really dangerous? [duplicate]

I have just started work for a small (100-150 employees) company. I noticed that anybody can remote in to the remote server using the correct domain, which is quite easy to guess based on the company ...
0
votes
0answers
31 views

I have a question on hardening my windows 8 host firewall rules

I use the following setup for my internet connection. MyPC/RDP -> RDS server -> Internet (this is over a paid public WiFi access point). What I want is to strengthen my Win 8 firewall rules (...
1
vote
0answers
483 views

Check the signature algorithm of RDP certificate

I received a Nessus warning of RDP as following, The following certificates were part of the certificate chain sent by the remote host, but contain hashes that are considered to be weak. |-Subject ...
-1
votes
1answer
102 views

Which of these configurations is better to stay anonymous on the internet? [duplicate]

MyPC > RDP > Windows VPS > Tor > Socks5 > Internet or MyPC with Tor sandboxed > socks5 > Internet. Which is better? Any better idea that doesn’t compromise on network speed?
0
votes
0answers
209 views

RDP - Why self signed certifcate is trusted on client-side?

Here is the issue I can't resolve. Remote RDP server presents a self-signed certificate, and I want to block any connection on client-side when RDP server is using non compliant certificate. I found ...
0
votes
1answer
204 views

RDP Audit Failures Brute Force Attacks

I need some help on tracking the source of these RDP access attempts on our terminal server. Port 3389 is open on the firewall (I know this is a terrible practice. I don't want to hear advice on ...
1
vote
1answer
2k views

Security Risk of Open RDP (3389)

I have often been told that allowing RDP access over the internet is a security risk - my understanding is that this logic stems from the idea that a potential hacker would brute-force the username ...
1
vote
1answer
337 views

Windows 7 RDP exposed to Internet

We are hosting a Windows 7 desktop Pro on a KVM machine, where a legacy software which does not run on a Windows Server 2008-16 is hosted. We are exposing it to Internet as users need to login once in ...
1
vote
3answers
121 views

Security of mapping Local Resources over RDP

I work with a group of developers that do network level program. To prevent these developers from accidentally causing problems on the corporate network they have been given there own isolated ...
0
votes
1answer
156 views

Windows Remote Desktop Tool

What are the security risks of allowing the Remote desktop connection to be enabled on machines within an organisation? From reading various blogs on the subject, I can stop the use of the MSTSC.exe ...
0
votes
1answer
69 views

Botnet tracing: Is SvcHost RemoteIP reliable or can it be spoofed?

On an RDP server, the "Resource Monitor" system app shows network connectivity by process in the "Overview" tab under "Network" section. In this section, I see an SvcHost process on TCP port 3389 for ...
3
votes
3answers
516 views

Improve RDP security: router with VPN or IP whitelist on firewall

I am considering to improve the security setting on our workstation shared within the university lab. We are sharing the workstation among lab members with RDP and got compromised recently. I highly ...
0
votes
1answer
183 views

If TCP is more “secure” than UDP, how would a practical UDP “attack” look, for example during the initiation of a MS RDP connection?

In accordance to the recent question Why is TCP more secure than UDP?. How would an "attack" look when it comes to the practical aspect? A great example would be the use of TCP or UDP for Microsoft ...
0
votes
0answers
303 views

MitM-attack on RDP connection - how sophisticated can it get?

So I know how MitM-Attacks work against RDP now and I have a bit of abstract knowledge about MitM-attacks in general. As far as I understand, as an attacker you want to listen to the traffic of your ...
1
vote
1answer
134 views

How can I know if an attack is still valid, if there is no CVE for it?

I found a PoC for a MitM-attack towards RDP published in March 2017 but no CVE in any of the databases and no mention of a patch by Microsoft. I want to know if this still works, how would I find out ...
1
vote
2answers
513 views

Port forwarding and port blocking security concerns

I am highly concerned about RDP security and about multiple occasions of ransomware infections through RDP, so now I am inspecting possibilities for self-defense against these threats. What interests ...
0
votes
1answer
126 views

What are the most common security threats that have to be considered when dealing with RDP? [duplicate]

I'm dealing with a hypothetical infrastructure for enabling workers to use RDP for remote access to their work PCs. These would be virtualized Win7 machines within a VMWare vSphere environment. ...
1
vote
1answer
80 views

Why Windows allows Administrator login via RDP by default?

Coming from a Linux background, this seems awful weird to me. Unlike Linux, where root login is denied by default in SSHd configuration, Windows users in Administrator group are allowed to login by ...
0
votes
1answer
4k views

How did hackers brute force my Windows server username?

About a year ago my Windows server 2008 R2 server was hacked. I had RDP open to the world, I know, not a good idea. Being that it was a year ago I don't have any of the logs, but I was thinking about ...
0
votes
0answers
289 views

PCI DSS and Windows Terminal Servers and 2FA

We are using a Windows Terminal Server farm (providing security function) to access servers in the CDE. CDE is segregated (VLAN/IP/FW) also the TS farm is segmented (VLAN/IP/FW). The only way to ...
1
vote
1answer
64 views

Dedicated application server security

I'd like to expose a machine running Windows Server 2012 to the internet. I plan to run a single application that uses a specific port (say 12345) and then use RDP through 3389 to logon and manage it. ...
0
votes
1answer
621 views

Is RDP secure enough? China/HK Access [duplicate]

I have offices in China and HK and for local internet all fine. International connectivity is very slow indeed - not usable. They need to access a terminal server in the UK and do this by using SSLVPN ...
7
votes
2answers
21k views

Is Two Factor Auth for RDP possible?

Is two factor authentication possible when using RDP with a Windows server, say by using a time dependent code?
81
votes
10answers
28k views

How secure is RDP?

I have a sort of a conflict with my company's Security Lead Engineer. He says that Remote Desktop Protocol (RDP) is not secure enough and we should be using TeamViewer instead. We use RDP not only to ...
0
votes
1answer
495 views

rdp connection with netcat pivoting

I want to connection from local computer to another local computer. I have 3 machine. for example A: 192.168.1.50 -> in local windows machine B: 50.3.52.110 -> linux server C: 192.168.5.25 -&...
4
votes
2answers
832 views

Brute Force RDP Attacks Despite Having RDP Restricted to 1 IP - HOW?

I restricted the Firewall incoming rules for RDP under Scope to 1 Remote IP address (Local IP Address section is empty). This was done for both Public & Private/Domain Rules. This action ...
2
votes
2answers
172 views

Email hacks via RDP

Someone has sent an email from my account that is making me look bad. I am trying to determine if someone either actually did it physically from my computer or via RDP. As there is reason to believe ...
10
votes
6answers
5k views

RDP Attempts From Unknown IPs, How to Protect?

I'm running Windows Server2008 R2, and seeing the following error multiple times with various IPs in the event log: The Terminal Server security layer detected an error in the protocol stream and ...
0
votes
1answer
98 views

Stolen Remote Desktop Protocol (RDP) credentials

I would like to know how to guard against RDP-renting services such as dedicateexpress.com which rents out stolen corporate laptops credentials. Are there IDS for such events?
0
votes
1answer
239 views

How to connect to Windows RDP and delegate authentication to a (reverse) proxy?

Looking for the following setup: Client connects to Windows RDP server through proxy server. The client is in public network hence can't send username/password for logon. The proxy server in between ...
1
vote
3answers
786 views

MAC address of source in RDP session

In a forensic analysis I analyzed the event logs of the affected machine and saw various RDP sessions from XYZ IP address. However to prove that the source IP was not spoofed is it possible that I ...
1
vote
0answers
547 views

Tunneling rdp over ssh as a network newbie

For whatever reason I need to access a virtual machine (Windows server 2008r2) on my home network from outside the network over the internet via remote desktop. I read that there are "concerns" with ...
2
votes
1answer
10k views

How to get more information on TermDD Security Layer Disconnects (Event 56)

In my Admin event log, I see the following errors: The Terminal Server security layer detected an error in the protocol stream and has disconnected the client. Client IP: XXX.XXX.XXX.XXX ...
2
votes
3answers
1k views

Unauthorized remote control performed today - teamviewer?

I came home a bit ago from an overnight trip and saw my PC screen moving around. I hoped it was just some ad animation but as I sat down I realized someone was opening 30+ tabs in my Chrome to an ...
1
vote
0answers
94 views

Under which circumstances is the default security profile of XRDP considered okay?

In xrdp.ini, the base install of xrdp on my raspberry pi*, there I have the following below. I changed crypt_level to high. [globals] bitmap_cache=yes bitmap_compression=yes port=3389 crypt_level=...
11
votes
2answers
4k views

Windows RDP over internet

I'm trying to figure out the risks of running RDP over the internet, using two windows 10 professional stations, and if a VPN is absolutely necessary to achieve good security. From the information I ...
2
votes
0answers
119 views

Wayland Partial Encryption for Mouse / Keyboard? (Also X and RDP)

Question What are the best practices for implementing Partial Encryption, to encrypt just the input devices (mouse/keyboard, etc), not the actual video display, during remote desktop sessions using X,...