How do I secure Remote Desktop sessions on Windows 2008 R2 server?

Question

I need to secure my RDP connections to a Win2k8 server with an SSL certificate, and I am hoping to use a self-signed cert that I can generate on the server.

The last time I tried this (on a Win2k3 machine), after installing the certificate, it I could no longer access IIS sites on the server using localhost without using SSL. This was a problem because I had a lot of local processes that made locahost requests and didn't specify https as the protocol.

I would like to install a SSL cert that only secures my RDP connections and does not affect IIS at all. Does anyone have experience doing this?

Answer 1

For TLS level security, You should be able to go to Administrative Tools, then Remote Desktop Services, Desktop Session Host Configuration. On the General tab, choose the appropriate security layer and encryption level from the drop-down boxes.

You have the following levels for security layers:

Low – uses 56 bit encryption for data sent from client to server. Does not encrypt data sent from server to client.

Client Compatible – this is the default. It encrypts data sent both ways between client and server with the maximum key strength that the client supports.

High – this encrypts data sent both ways between client and server with 128 bit encryption.

FIPS Compliant – this encrypts data sent both ways between client and server with FIPS 140-1 validated encryption.