2

I'm following this page on security tips for RDP (for my online server):

http://www.mobydisk.com/techres/securing_remote_desktop.html

Now I don't have a special user account for RDP access. Just the administrator can log on. However, I want to make sure that someone can't brute force the password.

I've set the 'account lockout policy' to 3 attempts and a retry after 3 minutes. However, when I connect back with RDP I can still try 5 times before RDP breaks the connection. I can then immediately reconnect and try 5 more times.

Any ideas if there is a lockout policy which also holds true fro the admin?

2
  • 1
    Many people handle this by simpling renaming the Administrator account. Yes it is a bit of obscurity-based-security, but it may help a little. After you rename you could create a un-privileged account with the name administrator.
    – Zoredache
    Feb 23, 2011 at 16:28
  • ok..so I create a new user and give admin rights and configure a proper lockout, and the real admin I just rename into something weird so it can't be guessed?
    – reinier
    Feb 25, 2011 at 13:29

1 Answer 1

2

You don't want to setup a lockout policy for your only Admin user.

Reason being: You create a major security hole in your setup as an attacker could prevent your access by simply continuously brute forcing against your admin access (a.k.a. The other side of account lock-out).

The best options are:

  • Restrict RDP to specific IP sources;
  • Rename the Administrator user

You don't list your Windows Version but here's how to do it on Windows 2003 and 2008.

Note: You can also use GPO to rename the account across multiple machines

2
  • Your point about the denial of service could apply to any account, not just the built-in Administrator account, which really should not be used on a regular basis.
    – Greg Askew
    Feb 18, 2013 at 12:36
  • Sure thing... but the person would have to enumerate the username first, which on a system with only RDP exposed to external parties is not trival - except if you allow that cute "known users" feature to run via RDP. The issue with Administrator/root (and to be fair with any other default account) is that you know exists and as such the brute forcing is easier. This - the ability to enumerate valid users - is one of the reasons why login error messages should NOT differentiate between incorrect username or incorrect passwords (cwe.mitre.org/data/definitions/204.html) Feb 18, 2013 at 12:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .