RD Session Host Security settings in Windows Server 2016 (SSL, High encryption, etc.)
Gpedit.msc, computer configuration, administrative templates, windows components, remote desktop services, remote desktop session host, security, see various options.
- “Require use of specific security layer for remote (RDP) connections” – Changing Security Layer to SSL is the recommendation listed in Windows 2016,
- “Client Connection Encryption Level to High” – enabled/Yes
- “Require Secure RPC communication” – enabled/Yes
- “Require user authentication for remote connections by using NLA” – enabled/Yes
Limit users who can login via RDP
By default, all users in the “Administrators group” have RDP access rights. And, of course, all users in the “Remote Desktop Users group” have RDP access rights too. If you only want some members of the Administrators group to have RDP access, you can adjust this in Local Security Settings as follows: by removing the “administrators group” and then making sure all required remote users are part of the “Remote Desktop Users group”.
Local Security Policy (secpol.msc) -> Security Settings -> Local Policies -> User Rights Assignment -> Allow Logon Through Remote Desktop Services, change settings to remove “Administrators group” (but make sure any users you want to have RDP access are already part of the “Remote Desktop Users Group” especially the one you are currently logged in with).
RDP Intrusion Prevention Software (Host based Intrusion Detection/Prevention) – RDP IP blockers (software for brute force protection against Windows RDP based on failed attempts from various IP addresses; some products also have geolocation blocking to block IPs assigned to certain countries.)
There are several third-party software products available that will lock out IP addresses after X number of failed attempts such as Syspeace, RdpGuard, TSPlus RDS-Knight, LF Intrusion Detection and more. Syspeace ($73/year or $0.20 per day with minimum $15 purchase) has a global blacklist feature as well as a geolocation feature to block IP address by location/county. During a test with the Syspeace software, we noted a majority of failed login attempts were geocoded to Russia and Ukraine. Another observation was when we changed the RDP port to something other than 3389, the failed attempts dropped to zero, although automated bots may have eventually found the changed port (we didn’t try it that way for very long).
Using a VPN with RDP is more secure because it provides two steps to access your network. You could require clients to connect with a VPN first before being able to RDP to the server. Unless you are using our Dedicated Server Hosting offering where you can have a hardware vpn device, you will need to install a software VPN on the server. One option is using the free built-in Windows VPN role service. Other software VPN options available have been Hamachi (acquired by LogMeIn), Zerotier which provides software defined networking capabilities, and other options.
WINDOWS SERVER BUILT-IN VPN ROLE:
If you are interested in setting up the built-in VPN role on Windows Server 2016 and then limiting RDP access to private IPs after VPN is connected, contact Riptide Hosting for a post we wrote on how to set this up. PPTP VPN using Windows Authentication is password based so strong/complex passwords are still very important. Other VPN protocols, certificate authentication, may provide stronger security depending on your needs and environment. You can use the built-in Windows VPN to setup a L2TP VPN with preshared keys too.
General steps to install the (free) built-in VPN role on Windows Server 2016:
- Add “Remote Access” server role with “DirectAccess and VPN (RAS)” role service.
- Open the Getting Started Wizard, select “Deploy VPN only”, “Configure and Enable Routing and Remote Access”, Select “Custom Configuration”, Select “VPN access” only. Start Service. Reboot
- Go into “Routing and Remote Access” properties, IPv4 tab to add static IP address pool with private IPs
- Change Network Adapter settings, IPv4, to add secondary IP from private IP range above
- Adjust User Properties for each user on the Dial-In tab to Allow “Network Access Permission”
- Setup VPN Connection on each user PC (may need to uncheck “use default gateway on remote network” if having internet issues on the PC)
- Adjust Server Firewall rules to disable RDP access on port 3389
- Test deployment (verify you can’t RDP without using VPN first, etc.)
- Our steps generally follow the steps in these links with a few additional items noted