In light of some recent worms I'm looking at ways to further restrict access to terminal services on my public facing Win2k3 server. Are firewall IP address restriction is not an option as the genuine clients are all on dynamic addresses.
It seems the most likely option is to set up IPSec VPN functionality on the server. That looks like it will involve a bit of fiddling around so I thought I'd check if anyone else has any experience doing this and whether or not IPSec is actually the simplest and lightest approach?