Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm following this page on security tips for RDP (for my online server):

http://www.mobydisk.com/techres/securing_remote_desktop.html

Now I don't have a special user account for RDP access. Just the administrator can log on. However, I want to make sure that someone can't brute force the password.

I've set the 'account lockout policy' to 3 attempts and a retry after 3 minutes. However, when I connect back with RDP I can still try 5 times before RDP breaks the connection. I can then immediately reconnect and try 5 more times.

Any ideas if there is a lockout policy which also holds true fro the admin?

share|improve this question
1  
Many people handle this by simpling renaming the Administrator account. Yes it is a bit of obscurity-based-security, but it may help a little. After you rename you could create a un-privileged account with the name administrator. –  Zoredache Feb 23 '11 at 16:28
    
ok..so I create a new user and give admin rights and configure a proper lockout, and the real admin I just rename into something weird so it can't be guessed? –  reinier Feb 25 '11 at 13:29

1 Answer 1

up vote 2 down vote accepted

You don't want to setup a lockout policy for your only Admin user.

Reason being: You create a major security hole in your setup as an attacker could prevent your access by simply continuously brute forcing against your admin access (a.k.a. The other side of account lock-out).

The best options are:

  • Restrict RDP to specific IP sources;
  • Rename the Administrator user

You don't list your Windows Version but here's how to do it on Windows 2003 and 2008.

Note: You can also use GPO to rename the account across multiple machines

share|improve this answer
    
Your point about the denial of service could apply to any account, not just the built-in Administrator account, which really should not be used on a regular basis. –  Greg Askew Feb 18 '13 at 12:36
    
Sure thing... but the person would have to enumerate the username first, which on a system with only RDP exposed to external parties is not trival - except if you allow that cute "known users" feature to run via RDP. The issue with Administrator/root (and to be fair with any other default account) is that you know exists and as such the brute forcing is easier. This - the ability to enumerate valid users - is one of the reasons why login error messages should NOT differentiate between incorrect username or incorrect passwords (cwe.mitre.org/data/definitions/204.html) –  Andre de Miranda Feb 18 '13 at 12:49

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.