Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

My client failed her PCI compliance audit. The server supports Remote Desktop (Terminal Service) but only provides encryption and not authentication. This exposes the server to Man-In-The-Middle attacks.

The supposed solution is to force SSL as the transport layer for RDP.

Anyone know how to do this?

The server runs Windows 2003.

share|improve this question

migrated from superuser.com Apr 12 '10 at 23:16

This question came from our site for computer enthusiasts and power users.

3 Answers 3

up vote 5 down vote accepted

http://support.microsoft.com/kb/895433

If the server has a cert from a trusted CA / Enterprise CA, skip to the section:

Step 2: Configure TLS authentication and encryption

share|improve this answer
    
hi yummy, i installed an SLL certificate using the following instructions, support.microsoft.com/kb/816794#3. but the certificate does not appear when i click "edit" from the "RDP-tcp Properties" dialog (when specifying a certificate for the SSL connection). any clues? –  Crashalot Apr 13 '10 at 20:28

This is exactly what the addition of Network Level Authentiation to RDP solves. I believe MS added it in Server 2008.

share|improve this answer

Upgrade to Windows Server 2008. Seriously - new RDP protocol, and TLS security is standard (at least I always get asked about whether to accept the unknown certificate between our domains - I have two domains that are not otherwise linked).

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.