Remote Desktop¶
Remote Desktop (RDP) gives a full interactive login over the network. It's the most attacked service on Windows because a working login is a working login. There are two cases.
Case 1: the README doesn't require it¶
Turn it off.
Settings → System → Remote Desktop → switch Off.
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 1 /f
Then disable the service so it can't be turned back on casually:
Set-Service TermService -StartupType Disabled -Status Stopped
Verify: netstat -an | findstr 3389 returns nothing.
Case 2: the README requires it¶
Leave it on and harden it. Every setting below is in gpedit.msc → Computer Configuration → Administrative Templates → Windows Components → Remote Desktop Services → Remote Desktop Session Host.
| Subfolder | Setting | Value | Why |
|---|---|---|---|
| Security | Require user authentication for remote connections by using Network Level Authentication (18.10.57.3.9.4) | Enabled | The attacker must authenticate before getting a login screen. This alone blocks most RDP exploits. |
| Security | Require use of specific security layer for remote (RDP) connections (18.10.57.3.9.3) | SSL | Forces TLS instead of the legacy RDP encryption |
| Security | Set client connection encryption level (18.10.57.3.9.5) | High Level | 128-bit encryption both directions |
| Security | Require secure RPC communication (18.10.57.3.9.2) | Enabled | |
| Device and Resource Redirection | Do not allow drive redirection (18.10.57.3.3.3) | Enabled | Otherwise the client's drives appear inside the session and files walk out |
| Device and Resource Redirection | Do not allow supported Plug and Play device redirection | Enabled | Same for USB devices |
| Device and Resource Redirection | Do not allow Clipboard redirection | Enabled | Optional; stops copy-paste out of the session |
| Session Time Limits | Set time limit for disconnected sessions | 1 hour | Abandoned sessions get cleaned up |
| Security | Always prompt for password upon connection (18.10.57.3.9.1) | Enabled | A saved password in the RDP client can't log in by itself; the user types it every time |
| Session Time Limits | Set time limit for active but idle Remote Desktop Services sessions (18.10.57.3.10.1) | 15 minutes | An abandoned session gets disconnected |
| Temporary Folders | Do not delete temp folders upon exit (18.10.57.3.11.1) | Disabled | Session temp files are cleaned up |
| Device and Resource Redirection | Do not allow drive redirection (18.10.57.3.3.3) | Enabled | Otherwise the client's drives appear inside the session and files walk out |
And on the client side, Remote Desktop Connection Client → Do not allow passwords to be saved: Enabled (18.10.57.2.3).
NLA also appears as a checkbox in Settings → Remote Desktop → Advanced settings.
Level 2: redirection and cloud clipboard¶
Apply these even when RDP stays on. Each stops something crossing between the session and the client.
| CIS | Setting (Device and Resource Redirection) | Set to |
|---|---|---|
| 18.10.57.3.3.1 | Allow UI Automation redirection | Disabled |
| 18.10.57.3.3.2 | Do not allow COM port redirection | Enabled |
| 18.10.57.3.3.4 | Do not allow location redirection | Enabled |
| 18.10.57.3.3.5 | Do not allow LPT port redirection | Enabled |
| 18.10.57.3.3.6 | Do not allow supported Plug and Play device redirection | Enabled |
| 18.10.57.3.3.7 | Do not allow WebAuthn redirection | Enabled |
| 18.10.57.3.3.8 | Restrict clipboard transfer from server to client | Enabled: Disable clipboard transfers from server to client |
| 18.10.57.2.2 | Remote Desktop Connection Client → Disable Cloud Clipboard integration for server-to-client data transfer | Enabled |
Level 2: off entirely¶
Level 2 disables RDP by policy (18.10.57.3.2.1, Connections → Allow users to connect remotely by using Remote Desktop Services: Disabled) and at the service level (5.21). That's Case 1 above, enforced so a user can't switch it back on in Settings.
Restrict who can connect¶
Only accounts the README names for remote access belong in Remote Desktop Users. Administrators can connect without being in it.
net localgroup "Remote Desktop Users"
net localgroup "Remote Desktop Users" bob /delete
Verify¶
reg query "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v UserAuthentication
reg query "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v SecurityLayer
reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v MinEncryptionLevel
reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fDisableCdm
reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fPromptForPassword
reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v MaxIdleTime
Expected: UserAuthentication 1, SecurityLayer 2, MinEncryptionLevel 3, fDisableCdm 1, fPromptForPassword 1, MaxIdleTime 900000 (15 minutes in milliseconds).
Example¶
README: "The IT staff (alice) manages this machine remotely." So RDP stays on. Set all the policy rows, confirm NLA is on, and check the Remote Desktop Users group: it contains bob and hacker. Remove both. alice is an administrator and connects regardless.