Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In light of some recent worms I'm looking at ways to further restrict access to terminal services on my public facing Win2k3 server. Are firewall IP address restriction is not an option as the genuine clients are all on dynamic addresses.

It seems the most likely option is to set up IPSec VPN functionality on the server. That looks like it will involve a bit of fiddling around so I thought I'd check if anyone else has any experience doing this and whether or not IPSec is actually the simplest and lightest approach?

share|improve this question
What worms are you referring to? How were you affected by said worms? – joeqwerty Aug 31 '11 at 12:36
Got this in the post from Amazon…. I wasn't affected just want to take some precautions over and above strong passwords. I'd prefer to avoid the brute force attempts polluting my event logs. – sipwiz Aug 31 '11 at 13:08
up vote 2 down vote accepted

Outside of a VPN solution which is the best solution obviously.

I have had clients in the past that insist on the best security possible for no money, LOL, seems redicules eh.

Anyway, aside from very strong passwords as you say, change the port number that Terminal Server listens to. Everyone knows port 3389 is Terminal Server so change it to something obscure, you can then close that port on their firewall and open the new one, make it something rediculesly high in the port range like 9000 that way it does not get scanned during a simple port scan from outside your network.

Afterwards go here and run the test, your should not see your terminal servers port on the list, hopefully you see nothing except your mail server if you have one

share|improve this answer
I already had an SSH service running so I closed port 3389 and used an SSH tunnel to connect. However that's not adding anything extra except obscuring the port. Looks like the IPSec VPN is what I should be looking at. – sipwiz Aug 31 '11 at 23:57
Agreed, the VPN is definitely the best solution. ;) – Tom Sep 1 '11 at 5:10

Take a look at setting up a "Terminal Services Gateway" or I think server 2008R2 calls it Remote Desktop Gateway. You setup an Internet facing IIS server to act as a gateway preferably in a DMZ off your firewall. Clients contact the server securely over HTTPS, secured with a certificated signed by a trusted public certificate authority. This server can in turn check against a policy server on (or what) is allowed to connect and can even do a health check to qualify what kind of RDP session is allowed, and it then pipes the RDP to the real destination server. You could have a policy that says only domain machines, or machines with a certificate you exported are allowed to connect.

FYI, this solution takes time, effort, and probably a little money, but it's EXTREMELY useful. Not compatible with the Mac OSX RDP client from Microsoft as of 6 months ago.

share|improve this answer
Yes I've seen that working in the past. If I recall correctly the solution also supports a terminal service client that runs as a browser plugin which can be handy. It will be too much in cost and effort for me though. I don't want to purchase an additional server or upgrade my existing Win2k3 one to Win2k8R2. – sipwiz Sep 1 '11 at 0:18

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.