Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a few Windows machines I need to open up, but I was wondering: how secure is RDP? I already found documents like this explaining how to improve security, so obviously it is not very secure by default (like 48 bit encryption...). But after changing those settings, how secure is it then?

I mean, my Linux servers I have open to the world with OpenSSH. I know the OpenBSD auditing and security policies and their history with security bugs, so I fully trust it. I also know Microsoft in that regard, so I don't trust it. But, that's just a feeling. I'd like to know what others think about / have experienced by opening port 3389 to the world.

share|improve this question

Well, it's not perfect, but it's good enough for most needs, il particular if you use the latest version and mandate network-level authentication. You can make it even more secure by adding a gateway server that will tunnel connections through SSL and protect your internal machines. Further refinement would be to use certificate authentication for the session but that's probably unnecessary.

As ever, though, the real question should be: what are you trying to protect and against what risk ? If you're going to RDP into the domain controller of your company, then you probably should invest into a few additional security measures (like the gateway server I mentioned) simply because causing a DOS on a DC can have real consequences fr your business. If you're just thinking of connecting to your home computer from the net (and already have descent security in place: good enough passwords and up-to-date OS), then it's probably not worth your while to secure it any further.

share|improve this answer
Mostly I was just wondering about bots/script kiddies which scan for known vulnerabilities. The consequences of a DOS'ed machine don't apply here (the machines aren't that critical). It's just that I want to keep people out. – Halfgaar Nov 6 '10 at 8:54
The latest versions of RDP from Microsoft have now have built-in support for TLS and RC4. – user48838 Nov 6 '10 at 9:03

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.