Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am a dev with little admin expertise, administering a single dedicated web server remotely.

A recent independent security audit of our site recommended that "RDP is not exposed to the Internet and that a robust management solution such as a VPN is considered for remote access. When used, RDP should be configured for Server Authentication to ensure that clients cannot be subjected to man-in-the-middle attacks."

Having read around a bit, it seems like Network Level Authentication is a Good Thing so I have enabled the "Allow connections only from Remote Desktop with NLA" option on the server today.

Is this acion enough to mitigate the risk of a Man-in-the-Middle attack? Or are there other essential steps I should be taking? If VPN is essential, how do I go about it?

share|improve this question
up vote 4 down vote accepted

You really should not have RDP open to the world, even with NLA on. NLA does cut down on MITM attacks, but if you are using the default self-signed certificate for RDP access, you're not all too secure.

One of the main reasons that you don't want to leave RDP open to the world is to prevent automated password cracking attempts. If you remove RDP from Internet-facing interfaces, you completely mitigate random, automated brute-force attacks. Putting something like a VPN in place for remote access is both highly recommended and useful.

There are many ways that you can implement a VPN. Windows has a built-in IPSEC VPN, for example. OpenVPN Access Server is also free for up to two concurrent users if you want to go the SSL VPN route.

If you need very specific instructions on how to set up a VPN, then you need to research the options, pick a technology, read the documentation, and then open a new question with any concerns or issues that you have implementing it. Just asking "How do I implement a VPN" is much too broad for Server Fault.

share|improve this answer
Thank you - very helpful! – jamesfm Nov 22 '11 at 17:07

In the same way that a user can click right through an SSL warning in their browser, the avoidance of man-in-the-middle attacks is still the responsibility of the user.

All that this change has accomplished is to prevent the connection of older clients that don't support NLA (and the server identity validation that that provides).

For RDP version 6 clients, they're no more and no less vulnerable to an attack as they were yesterday - a user clicking through a server identity dialog box is all that needs to happen for a man-in-the-middle attack to be successful.

share|improve this answer
You're really only preventing Windows 2000 clients anyway, by turning NLA on. Windows XP SP3 can be made to use CredSSP with a couple of minor (and supported) registry tweaks. – MDMarra Nov 22 '11 at 16:56
@MarkM Good point. – Shane Madden Nov 22 '11 at 17:01

No, NLA is designed to minimize the attack surface of the Remote Desktop server. The man-in-the-middle protection occurs when you configure your Remote Desktop server connection with a valid certificate. However, if users dismiss the warning that appears if the server or certificate is not trusted or valid, they may still connect to an hostile Remote Desktop server, and that vulnerability has nothing to do with your Remote Desktop server.

Configure Network Level Authentication for Remote Desktop Services Connections

"Network Level Authentication completes user authentication before you establish a remote desktop connection and the logon screen appears. This is a more secure authentication method that can help protect the remote computer [remote desktop server] from malicious users and malicious software. The advantages of Network Level Authentication are:

"It requires fewer remote computer [remote desktop server] resources initially. The remote computer uses a limited number of resources before authenticating the user, rather than starting a full remote desktop connection as in previous versions.

"It can help provide better security by reducing the risk of denial-of-service attacks."

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.