Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [rdp]

Remote Desktop Protocol, a protocols for accessing Windows applications remotely

Filter by
Sorted by
Tagged with
0 votes
0 answers
68 views

Security of RDP directly with administrative account VS RDP with normal account and elevation with administrative account

I've had some arguments with people about securing RDP access to servers: Team 1 (including me) suggests that direct RDP access should only be possible with an (separate) administrative account. Team ...
Don Zoomik's user avatar
0 votes
1 answer
215 views

Which is more secure to access a VMware Windows VM : VMware Remote console or RDP+Remote Desktop Gateway

Without knowing more details, I can't suggest to our security guy that we should use RDP along with a Remote Desktop Gateway. One person says to that VMware Remote Console is more secure than using ...
SebMa's user avatar
  • 101
2 votes
1 answer
774 views

RDP logout necessary to prevent RDP session hijacking?

We recently got a strengthened security policy where people are required to log out of any RDP connections at the end of the day. So when I turn off my laptop, it is not enough to merely close the RDP ...
timppu's user avatar
  • 21
1 vote
1 answer
499 views

Does enabling rdp induces a security risk coming from the internet if no port forwarding/nat is configured?

The question is mainly about the default windows implementation of rdp, but could also apply to xrdp. Enabling rdp is an option in the windows settings (remote desktop). I would like to use rdp in a ...
user9203881's user avatar
1 vote
1 answer
401 views

RDP Brute Force Attacks

I've discovered my VPS server with RDP access is getting attacked. Event log shows a bunch of 4625 events. Now I know for using RDP, this is just the nature of things. I have changed the RDP port ...
Jason Chu's user avatar
1 vote
2 answers
3k views

Is RDP wrapper any more or less secure than the built-in RDP?

I have read several sources indicating that RDP may have some vulnerabilities. Without delving into that, is RDP wrapper any more or less secure than the built-in RDP, when it is enabled? I read ...
sancho.s ReinstateMonicaCellio's user avatar
1 vote
1 answer
364 views

X11 forwarding to another user. How it's possible?

I would like to understand how the following problem is technically possible: In my company, we have a machine which I and several colleagues connect to. I regularly use x11 forwarding when I connect ...
Hantlowt's user avatar
5 votes
2 answers
6k views

How is RDP through VPN safer?

I've read that I shouldn't open RDP ports on my router (obviously with port forwarding, I don't mean opening 3389 port directly). Instead I should use something like VNC (I get that solution) or ...
Jorhanc's user avatar
  • 153
1 vote
0 answers
775 views

How to get the list of computers a user can RDP into using BloodHound?

Using bloodhound I would like to find the list of all computers a user I.e "domain\ajohn" can RDP into. I looked at: match p=(g:Group)-[:CanRDP]->(c:Computer) where g.objectid ENDS WITH '-...
John's user avatar
  • 11
0 votes
0 answers
169 views

Bruteforce on RDP [duplicate]

I have an internet-facing RDP server and getting constant brute force attacks trying random usernames and passwords. It's Windows 2016 with remote desktop services enabled. What can I do to stop this ...
Shofi's user avatar
  • 1
-1 votes
1 answer
338 views

How to protect Windows Remote Desktop Client from untrusted server

We have blocked all direct connections from client computers to the Internet in our firewalls and only allow Internet access via http and https through a Squid proxy. Now one of my users requests ...
Tilman Schmidt's user avatar
0 votes
0 answers
549 views

How can I check the validity of a selfsigned xrdp certificate

I am connecting to a fedora xrdp server from the built-in Windows Remote Desktop client. I have access to the /etc/xrdp/key.pem and to the certificate inspection window on on Windows Remote Desktop ...
afiori's user avatar
  • 101
0 votes
0 answers
131 views

Firewall IP-Filtered Pinhole Risks

To facilitate consulting work, a client has suggested that they allow me to connect directly to an in-house remote desktop server, via a firewall pinhole which allows connection from my IP address ...
Geoff's user avatar
  • 101
1 vote
1 answer
269 views

RDP to a Virtual Machine. Where should I apply the security measures? [closed]

I have a computer with Hyper-V installed and a virtual machine. I want to connect only and directly to the VM with Remote-Desktop from outside the network. I have some good ideas to make the ...
kongiponki kongiponki's user avatar
0 votes
1 answer
202 views

RDP security review over private VPN

I know Remote Desktop Protocol can be incredibly insecure if handled wrong. Knowing no system is 100% safe, are there any easy to exploit vulnerabilities in the described system below; ZeroTier VPN: ...
Hethradiah's user avatar
0 votes
0 answers
848 views

Disabled MD5 and enabled SHA under SCHANNEL/Hashes in registry. xfreerdp fails with an ssl i/o error

So delving into securing server and not quite understanding how I broke the ability to rdp into my server (using xfreerdp). I disabled MD5 as an available hash and enabled SHA. The exact changes in ...
IT_User's user avatar
  • 212
1 vote
1 answer
357 views

How do I get my server HSM working while connected via RDP? (Win 2019)

The error I get from pkcs11-tool.exe is "No slots." My server has a hardware security module (Nitrokey HSM 2) that becomes inaccessible once I connect to my server via Windows Remote Desktop....
Jacob Bruinsma's user avatar
1 vote
2 answers
1k views

Multiple Established TCP Connections on Port 3389 - Is my server compromised?

If i run netstat -an on my Windows Server 2019 it shows multiple connections on Port 3389 (which is RDP) The first IP Adress is mine, however i cant explain the other two connections. They both ...
J Doe's user avatar
  • 41
1 vote
1 answer
2k views

Are Credentials used in RDP cached on Client?

When I enter my domain admin user credentials into the RDP Window, does the Client also save my password hash? Example: Windows 10 Client -> Remote Desktop -> Enter Domain Admin User and ...
skiriakidis's user avatar
-1 votes
1 answer
147 views

How can you attack or redirect the client from the server over an RDP or SSH conneciton? [closed]

I have a penetration testing scenario where I am on the network with two machines, Machine A and Machine B. I have complete control over Machine B and am trying to leverage that to get access to ...
PenetrationTester's user avatar
0 votes
0 answers
168 views

How to secure remote desktop?

How to secure RDP connection to prevent the spread of ransomware from users' systems when they connect to corporate systems through remote desktop?
Milad Nobakht's user avatar
1 vote
2 answers
1k views

Does VNC need hardening when inside LAN (home network)?

This is a very newbie question, but I would just like to make sure that I'm not missing anything: If I connect via VNC protocol to my various servers etc. inside my own LAN (home network), then should ...
Richie79's user avatar
-2 votes
1 answer
2k views

Does using a VPS hides the client identity in the web?

I know that a VPS provider can track the client connected to a VPS (This Q/A) using RDP(Remote desktop protocol). But my question is about websites accessed from the VPS using a browser. Can they know ...
Ali Sheikhpour's user avatar
0 votes
0 answers
122 views

How to prevent configuration of Public IP on an interface

I have recently identified a security risk with some of the machines (primarily Windows 10 and MacOS laptops) my company issues to users. Specifically, a small subset of the users are regularly ...
khantext's user avatar
1 vote
1 answer
274 views

Connecting to server with Proxy vs VPN

Suppose I have a server and no-one can hack into my local area network. I want to Remote Desktop into my server from Internet. Exposing RDP is the most foolish thing I did do once and the server was ...
Bhavya Gupta's user avatar
4 votes
2 answers
3k views

Remmina RDP Certificate Fingerprint Changed

I've been using Remmina to connect to my RDP server across the internet. When I first connected to the server, I had to accept the certificate. I have not had to do that since the first time I ...
Doug's user avatar
  • 41
0 votes
2 answers
6k views

RDP Authentication with domain credentials

There's something I don't get with RDP in a domain. During an authentication, if we're using a local account of the distant machine, then the creds are in the SAM so all good. But with a domain ...
Daycopo's user avatar
1 vote
2 answers
755 views

RDP - access security

I have a question about protecting myself against attacks on the RDP service. I note that I have already done the appropriate configuration: I am using a local user (not administrator) to connect ...
mlik's user avatar
  • 11
0 votes
0 answers
37 views

How is it possible for people to reverse a GoToAssist session? [duplicate]

I am puzzled by how people on Youtube bait scammers into connecting to their machines and end up "reversing" the connection on them. Essentially controlling the scammer's PC. Is this done via reverse ...
ng.newbie's user avatar
  • 275
1 vote
0 answers
162 views

Reasonable security for RDP over VPN

An organisation I work with requires that employees be able to connect to machines on their network and log on to them from machines that are not on the network and not joined to the domain. They ...
Grismar's user avatar
  • 111
0 votes
0 answers
2k views

Is RDP user enumeration possible?

There are many pre-made tools around for brute-forcing RDP credentials, but I haven't found one for username enumeration. Is it possible by design to enumerate potential RDP logins? If not within the ...
Vilius Povilaika's user avatar
0 votes
0 answers
568 views

RDP with self-signed cert requiring password before launching display

I've noticed that the search engine Shodan grabs screenshots from hosts running an RDP service, even if they offer a certificate. To my understanding, the certificate is used to authentify the server,...
Redouane Red's user avatar
2 votes
4 answers
7k views

Can a website detect remote operation of a computer?

I was wondering if a website I am visiting can detect whether or not the computer that is being used is being operated remotely. For example... I have two desktops. I use Desktop 1 to remotely ...
Outcahst's user avatar
0 votes
2 answers
2k views

Whonix with Remmina to Connect on RDP - Is it safe?

I do not want my ISP logging any of my data, and do not trust my VPN either. Is it a safe measure to use Whonix in a VirtualBox, connecting over VPN, then using remmina to connect to an RDP? My goal ...
Just a guy on internet's user avatar
1 vote
0 answers
153 views

Abusing RDP/SSH post exploitation [closed]

I'm curious to how an attacker would enable RDP/SSH and use it to gain further access to the compromised windows server after achieving remote command/code execution on the server. (Using cmd.exe)
Jake Leroy's user avatar
1 vote
1 answer
163 views

RDP to Azure VMs through public IP versus VPN

I have two options for remoting into our Azure VMs: RDP to public IP or RDP through VPN. I'm certain using a VPN is 'more' secure. But my question is: Is it still reasonably secure to have a hole in ...
BVernon's user avatar
  • 181
0 votes
0 answers
186 views

Remote Desktop compromised

So roughly 2 weeks ago my Remote Desktop was compromised whilst I was actively interacting with my server via Rdp I was prompted with a disconnect status equal to “ Another user has connected to ...
user213965's user avatar
1 vote
1 answer
3k views

Windows RDP logging into itself?

There is a computer system that has to have RDP on an open port(I fought against this of course). I secured this via RDPGuard which worked phenomenally. Anyway, after a few weeks I check back on those ...
Mig S.'s user avatar
  • 11
0 votes
2 answers
1k views

Malware spreading through jump server and SSH data transfer

Can someone explain to me how jump servers mitigate the risk of malware infection please? Whilst I understand some of the benefits of having a jump server as an extra layer of defence i.e. ...
secanon's user avatar
  • 13
0 votes
2 answers
1k views

Is it possible for specific event logs to have been deleted?

I'm analyzing several hacked machines on our network. On the original hacked machine, I've found event logs indicating a series of successful RDP connections to other machines, but when I go to those ...
S.C.'s user avatar
  • 170
1 vote
1 answer
183 views

Steps to Harden Ancient Gaming Server

I am somewhat administering an old Windows Server 2008 server that is used to host a older Video Game. It's in such a state that it has tons of custom code on it that run the server and hasn't really ...
Verac's user avatar
  • 41
1 vote
1 answer
784 views

Finding the reason behind an RDP Certificate Change (man in the middle attack?)

I've installed some new networking equipment: firewall, switches, vlans, etc. I won't mention the brand name here, because I don't want to cause them harm by my suspicions. Right after doing this, I ...
Lonnie Best's user avatar
-1 votes
1 answer
325 views

Windows Remote Desktop access modes and security/functionality? [closed]

What are the security implications of running a Windows RDS farm vs. just using RDP for remote administration?
Hilo21's user avatar
  • 33
0 votes
0 answers
278 views

CanRDP right set to computer account?

I was querying a domain and found an interesting ACL that I haven't seen before. One of the DomainComputer accounts has a CanRDP right set to another domain computer. How would this work? The domain ...
ptr0x01's user avatar
  • 121
1 vote
1 answer
491 views

Windows server 2016 Remote Desktop username leaked

One of our servers got infected with ransomware last week (Matrix, .Grhan). The server allowed remote desktop connection from outside on the default port, which was a big security hole (and also, the ...
appl3r's user avatar
  • 133
1 vote
1 answer
846 views

Metasploit MacOS victim - tools to enable remote desktop / GUI view of the victim

If the exploited victim OS is Windows, metasploit has the getgui command to run RDP. Then he can manipulate the victim OS through the GUI desktop interface. meterpreter > run getgui -u loneferret -...
Johnny Pralo's user avatar
6 votes
1 answer
1k views

I'm hacked without telling anyone my ip [duplicate]

I have a pc with static IP bought from my ISP and RDP enabled. I was using this PC for development and didn't tell or use it for any communication purpose so it's not possible that someone knew about ...
Ammar Hussein's user avatar
3 votes
0 answers
137 views

Is it possible for a remote machine to "escape" from a folder mapped through RDP?

Although most people seem to share entire drives with RDP, it is possible to share individual folders, by mapping them to a drive for example with subst <lettertomap>: <pathtofolder> (for ...
gbr's user avatar
  • 270
3 votes
2 answers
235 views

RDP violation without credentials

On a Windows Server 2003 machine seems like someone has logged in through RDP without using credentials: there is a logged access, but there are nor userid nor password. I am wondering how is this ...
Flash's user avatar
  • 33
1 vote
1 answer
6k views

Best tool to BruteForcing RDP

I have tried many tools and to do not seem to be successful with locking out an account I am testing on my network with an RDP domain. I used crowbar, ncrack and THC hydra but they don't seem to be ...
john_zombie's user avatar