Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

When connecting to a Windows Server (2003 or 2008) desktop through RDP from a local Windows (7 or XP) PC with networks shares enabled (usually, the local C: disk will be shared with the remote server), is there a real chance that a virus infects the remote server?

Of course, we protect our local PCs as good as we can, so I'd just like to know if it makes sense to have a policy to restrict file transmissions to FTP or WebDAV and prohibit shares.

I believe a question like this should have been asked before, but I couldn't really find anything.

share|improve this question
    
It's possible, yes, but plausible is another story altogether. –  gravyface Oct 11 '11 at 12:07
    
@gravyface: thanks - but can we look into that "other story" a bit deeper? I'd love to get a solid gut feeling if we need to close that possibility or not. –  Olaf Oct 11 '11 at 12:18

3 Answers 3

up vote 3 down vote accepted

There's no automated mechanism where a virus would spread through the shared local drives. Unless you count users as Automated Tools of Destruction™ (which I would not underestimate).

We block such access for a couple reasons:

  • Users have a nasty habit of exploiting any superfluous features we allow for their personal enjoyment (and/or accidentally), usually leading to me cleaning up some sort of mess (like that 90+GB of home pictures someone accidentally copied). It doesn't have to be a virus to bring the server to it's knees.
  • We can worry less about what the users are copying off our network. You might not be in the same position we are, but we have financial and personal data laying around everywhere. Most users have access to it. We want to limit their copying of that data to external places to mechanism that are logged and generally easy to trace.
  • There's basically no use case for that access in the first place. We already have a file transfer website, easier and more reliable than copying files in a RDP session. I've only ever had one user ask about transferring files, and one other user ask about printing (which is also disabled by policy).
share|improve this answer
2  
+1 for the "Automated Tools of Destruction" that actually made me LOL –  Coding Gorilla Oct 11 '11 at 14:31

Yes, if you run programs from your shared disk. Autorun don't work (with default settings).

share|improve this answer
1  
Ok, but that would be a rather unlikely scenario. I was rather thinking about an automatic infection. –  Olaf Oct 11 '11 at 12:31
    
It is more probable that the user will run an infected program from a shared disk rather than a virus with RDP "skills" to reach your server. –  migabi Oct 11 '11 at 13:51

YES, INDEED.

Allowing disks to be mapped through a RDP connection is almost as insecure as letting someone go to your server and plug a unknown USB stick in it. There is no extra layer of security here. Users would of course have to open up the dangerous files, like any other virus infection.

The options are simple:

  • Don't allow disk mappings (use sharepoint in combination with UAG or similar instead)

or

  • Secure your server(s) (with antivirus, anti-spyware etc, wich you should do anyways)

Firewalls doesnt help anything, as the RDP session is already encrypted.

share|improve this answer
1  
To clarify; map the drive/share, you can have malware copied to the server. Executing it is a second (and separate) step. So unless your users are being malicious or are being targeted for exploiting your network, having only RDP access is relatively safe. –  Bart Silverstrim Oct 11 '11 at 14:13
1  
Automated attacks (copy and execute) would normally require taking advantage of an exploit. I'd be more worried about your users web browsing from the RDP session and infecting themselves with malware. –  Bart Silverstrim Oct 11 '11 at 14:14

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.