Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

After adding the Remote Desktop Session Host roll to a server the following firewall rules get created and are enabled by default.

Name                                 Group                Profile    Enabled    Action    Override    Program                              Local Address    Remote Address    Protocol    Local Port             Remote Port   Allowed Users    Allowed Computers    
Terminal Services - WMI (DCOM-In)    Terminal Services    All        Yes        Allow     No          %systemroot%\system32\svchost.exe    Any              Any               TCP         135                    Any           Any              Any    
Terminal Services - WMI (TCP-In)     Terminal Services    All        Yes        Allow     No          %systemroot%\system32\svchost.exe    Any              Any               TCP         RPC Dynamic Ports      Any           Any              Any    
Terminal Services (NP-In)            Terminal Services    All        Yes        Allow     No          System                               Any              Any               TCP         445                    Any           Any              Any    
Terminal Services (RPC)              Terminal Services    All        Yes        Allow     No          %systemroot%\system32\svchost.exe    Any              Any               TCP         RPC Dynamic Ports      Any           Any              Any    
Terminal Services (RPC-EPMAP)        Terminal Services    All        Yes        Allow     No          %systemroot%\system32\svchost.exe    Any              Any               TCP         RPC Endpoint Mapper    Any           Any              Any    

What is Terminal Services doing that it requires WMI, RPC, and NetBIOS to be enabled?

share|improve this question
    
Back door for Microsoft and the FBI, clearly. With port 445 open, all your file shares are accessible from the Internet. Just more "License server" garbage. Even a zero-day vulnerability in June 2012: randomoracle.wordpress.com/2012/06/05/… "Confronted with the risk of getting the enterprise 0wned, the prudent CSO would opt for paying more for software upfront, instead of worrying about one more useless component that creates additional opportunties for attack without any redeeming value– if they had the choice." –  Triynko Sep 24 '12 at 21:54
add comment

1 Answer

up vote 1 down vote accepted

Based on a cursory Google search, it looks like it's related to communication with a RDS License server and for remote management of the RDS role.

share|improve this answer
    
Can you link to the pages that told you that? –  Scott Chamberlain Jun 6 '12 at 19:24
    
Following are the Google search results. I only took a cursory glance and didn't do any exhaustive research or testing, so it probably needs further research: google.com/… –  joeqwerty Jun 6 '12 at 20:09
    
So why are inbound ports enabled when you install the session host roll. I could understand installing it if you install the license server, but not session host. –  Scott Chamberlain Jun 6 '12 at 20:16
    
I'm not sure but it probably warrants additional investigation. Maybe I should have posted a comment rather than an answer since my answer is really more akin to "It might be this" rather than "This is it". –  joeqwerty Jun 6 '12 at 20:18
    
I just discovered this today. I'm not happy that port 445 (file sharing) is left wide open to the internet by that terminal services firewall exception. I'm about to disable all exceptions whose name starts with "Terminal Services", because frankly the only port related to it that I expected to be open was the default remote desktop port, which I don't even use the default port (why would they ever recommend using the default port?). It looks to me like some kind of intentional "back door" access. I'm >< that close to ditching Windows Server because of this. –  Triynko Sep 24 '12 at 21:47
show 1 more comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.