0

Office users access a win2003 server from within the office using thin clients and terminal services. In reviewing the security settings it seems, by default, all users in the 'Remote Desktop Users' group can access the server from outside the office, e.g from home.

We want make it by default that most users can only access the server from within the office, with another user group for the few who actually need external access.

1 Answer 1

6

You could block the external port 3389 on your firewall and require the users you'd like to be able to dial in remotely to use a VPN connection. This provides two layers of security, and only the users you want to have access externally would receive a VPN account. Once on the VPN connection, they could simply use the RDP client to connect to the terminal server.

4
  • 3
    +1 to firewall it off, add a VPN client to users who want to access from outside the intranet. Simplifies things. Jul 25, 2011 at 20:24
  • Sounds good, but I would suggest taking a look at the Terminal Services Gateway service as well. This adds some additional security, and doesn't require much in the way of special configuration on the client side. It is very easy to setup ACLs about who can access what.
    – Zoredache
    Jul 25, 2011 at 21:28
  • we changed the default port for ts access for starts. vpn is probably the long term solution. i think ts services gateway is only available on win2008 server. thanks for the comment.s Jul 26, 2011 at 22:21
  • It should be noted that only the gateway machine needs to be Server 2008, and not the terminal server itself. A VPN is likely a cheaper alternative as most firewalls have the capability built in already.
    – DKNUCKLES
    Jul 27, 2011 at 12:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .