Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My client failed her PCI compliance audit. The server supports Remote Desktop (Terminal Service) but only provides encryption and not authentication. This exposes the server to Man-In-The-Middle attacks.

The supposed solution is to force SSL as the transport layer for RDP.

Anyone know how to do this?

The server runs Windows 2003.

share|improve this question

migrated from Apr 12 '10 at 23:16

This question came from our site for computer enthusiasts and power users.

up vote 5 down vote accepted

If the server has a cert from a trusted CA / Enterprise CA, skip to the section:

Step 2: Configure TLS authentication and encryption

share|improve this answer
hi yummy, i installed an SLL certificate using the following instructions, but the certificate does not appear when i click "edit" from the "RDP-tcp Properties" dialog (when specifying a certificate for the SSL connection). any clues? – Crashalot Apr 13 '10 at 20:28

This is exactly what the addition of Network Level Authentiation to RDP solves. I believe MS added it in Server 2008.

share|improve this answer

Upgrade to Windows Server 2008. Seriously - new RDP protocol, and TLS security is standard (at least I always get asked about whether to accept the unknown certificate between our domains - I have two domains that are not otherwise linked).

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.