up vote 3 down vote favorite
1
share [g+] share [fb]

My client failed her PCI compliance audit. The server supports Remote Desktop (Terminal Service) but only provides encryption and not authentication. This exposes the server to Man-In-The-Middle attacks.

The supposed solution is to force SSL as the transport layer for RDP.

Anyone know how to do this?

The server runs Windows 2003.

link|improve this question
25% accept rate
feedback

migrated from superuser.com Apr 12 '10 at 23:16

This question came from our site for computer enthusiasts and power users.

3 Answers

up vote 5 down vote accepted

http://support.microsoft.com/kb/895433

If the server has a cert from a trusted CA / Enterprise CA, skip to the section:

Step 2: Configure TLS authentication and encryption

link|improve this answer
hi yummy, i installed an SLL certificate using the following instructions, support.microsoft.com/kb/816794#3. but the certificate does not appear when i click "edit" from the "RDP-tcp Properties" dialog (when specifying a certificate for the SSL connection). any clues? – Crashalot Apr 13 '10 at 20:28
feedback
up vote 1 down vote

This is exactly what the addition of Network Level Authentiation to RDP solves. I believe MS added it in Server 2008.

link|improve this answer
feedback
up vote 1 down vote

Upgrade to Windows Server 2008. Seriously - new RDP protocol, and TLS security is standard (at least I always get asked about whether to accept the unknown certificate between our domains - I have two domains that are not otherwise linked).

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.