Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

From my research, I've come to understand that "Installing Terminal Server (Remote Desktop Services) on a Domain Controller (Active Directory)" is a cardinal sin - apparently there are some serious security risks.

Could someone please elaborate and explain the risks?

More specifically:

How would someone go about compromising the server? What is the worst that could happen?

Understand these aspects of my particular configuration:

No files are being stored on the server. The directory is only being used to authorize users to use Remote Desktop Services. The server will be accessed by less than 50 users.

Thank you.

share|improve this question
    
Wait this is just for a simple RDP to a single isolated server? for what are you creating this disaster for especially as you made it clear there are no files for the users...? Do not allow users to RDP to a DC period.... I thought you wanted a remote desktop gateway on a DC... which also you should not do as per my answer. –  Campo Mar 9 '11 at 2:01
    
To serve applications. "Just don't do it" - I would like to better understand why not to do so and/or why it would be a disaster. What is the ratio of risk to the conservation of resources? How likely is intrusion likely to occur? How easily can worst case scenarios (malicious user "selects all, deletes") be mitigated by having duplicate standbys? For example, common practice would be to have three servers (two DCs and one TS [or maybe even two TS]), that's four Windows installs vs. two Windows installs if they roles are combined. –  Earls Mar 9 '11 at 2:25

3 Answers 3

up vote 2 down vote accepted

The simplest things I can think of right off the bat: Start a process that fills the hard drives or RAM and crashes the server.

More insidious tactics would use everything from cache and side band attacks to malware and hacking toolkits to derive any and all information from AD, including potentially reversible passwords, security and other sensitive information.

share|improve this answer
    
This assumes they have compromised a user account, correct? What if users can only run a small subset of authorized applications? –  Earls Mar 9 '11 at 2:15
1  
@Earls - how 'bout just a compromised user? Most hacks are inside jobs. –  Joel Coel Mar 9 '11 at 3:21
    
@Earls, there are no absolutes in security. Sounds like you're already decided on doing this, so the only thing you can do is make the situation as reasonably secure as your policies demand. Separating the roles adds a very large security buffer, but doesn't guarantee anything anyway. –  Chris S Mar 9 '11 at 13:20
    
I'll give it to you for being honest... I guess it's just something I'm going to have to learn from experience. If users wreck their terminal server, they're not going to be using it whether it's a separate server or not. I understand the concern about "l33t users" attempting to flex, but luckily in my case, all of my users are extremely timid and inept - to the point they have to be educated to copy and paste. Hopefully, with due diligence, I can mitigate unintentional catastrophes of ignorance. I'm new to server configuration and deployment, but not GPO. Thanks. –  Earls Mar 9 '11 at 16:27

When someone connects to a machine via remote desktop, they are using that machine just like they are sitting in front of it. Doing this with a domain controller would be like putting your domain controller at a user's (or several users) desk for use in their day-to-day work. Everything your users do that might possibly change the state of machine is happening right there to the system hosting your active directory. Forget malicious hackers for a moment (not that they aren't a problem too) — the chances that one of your own users accidentally breaks something important or runs a resource intensive app creating an effective denial of service approach 100%.

share|improve this answer
    
I concur that may be a valid concern, but I assume you were downranked because controlling your users should be a trivial exercise via group policy, no? –  Earls Mar 9 '11 at 2:27
    
That could be, but if so it's pretty weak: unless your group policy-fu is perfect, you're still in trouble. I suspect the real reason is my assertion that using a terminal services desktop is just like sitting at the console -- while the sentiment is accurate, this is a slight exaggeration. –  Joel Coel Mar 9 '11 at 2:32
1  
@Earls - as someone who has spent a lot of time and effort into locking down terminal servers by group policy (especially with some... "power" users who are always finding ways to circumvent it, deliberately or not), it's most definately not a trivial task. We have spent cumulatively maybe 40 hours refining our GPOs on terminal servers. –  Mark Henderson Mar 9 '11 at 3:14

A Remote Desktop Gateway configuration should be run on the perimeter network. This allows for risks due to the very nature any sort of remote access port exposed....

Therefore if a remote attacker were able to compromise your Remote Desktop Gateway they would find themselves inside your DC.

This could be accomplished using man in the middle attacks, and/or forging the certificate to name just a couple.

You absolutely SHOULD NOT install your Remote Desktop Gateway on your DC. If you have the power on the current server to put it in a VM that is better, or on another physical machine.

Take a look at the following documentation. I found this very helpful at setting up a basic RD Gateway

Part 1

Part 2

Here is the MS whitepaper

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.