Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have a Windows Server 2008 Standard box running a terminal server that members of our team connect to from off-network locations via a firewall rule in our router (Linksys RV042) . For security reasons we have changed the default TS port to an unused high level port number.

We would like to add an additional layer of security that would be a username/password challenge unrelated to the terminal server and unrelated to the user's login credentials. I'm not sure this is even possible.

What I want to do here is like adding an Apache password challenge via a htaccess file on the wp-admin directory of a wordpress install, that has it's own login. So the first authentication mechanism is via a service that doesn't run the second authentication mechanism.

Any ideas how we might do this?

share|improve this question

Does your firewall support authenticating users based on service, rule, or application (RDP)?

Also, how does changing the RDP port on the server make it more secure? Anyone scanning your network range for listening ports will just find the new port, instead of finding the default port.

share|improve this answer
@joeqwerty - (Great question!) Changing the port makes it more secure in 2 important ways: First, most port scanning is done on the common ports, below 10k. Those other 50k ports just aren't used enough to be worth most people's scanning time. Second, since it's an unexpected change it adds a (modest) layer of security to the principle of defense in depth, an important method to securing systems. – Justin Oct 31 '09 at 15:57
@Justin: Thanks for your follow up. When I'm conducting an audit I scan all ports. A good port scanner can scan usually scan all ports in a matter of a few minutes. I would also say that it's not really an unexpected change, since hackers have the same mentality as you and I, if you're thinking about changing the default port to some unexpected port then they're thinking that you're doing that and scanning all ports to see what's listening. I understand the concept of removing low hanging fruit but IMHO security through obscurity isn't a very robust methodology. No offense intended. – joeqwerty Oct 31 '09 at 16:17
Anyhoo, does your firewall support any type of rule, service, or application based authentication, such as "connections connecting to this service, application, or rule need to authenticate first" type of thing? – joeqwerty Oct 31 '09 at 16:20
Security by obscurity is just breaking defaults for users, typically there is very little, if any, security gained. – sparks Oct 31 '09 at 16:44
@joeqwerty - I didn't find anything, no. – Justin Nov 2 '09 at 19:39

Have you considered Server 2008 Terminal Services Gateway? It would improve both the encryption used for securing the connection and provide you greater control over RDP.

share|improve this answer
@Furious - I don't think this is what I need. It just means I connect in another, one-method way. – Justin Nov 2 '09 at 19:48

You can make the terminal server its own domain controller, in its own domain. Let the main domain trust the TS-domain. Have the TS users authenticate against the TS-domain. Add the TS-domain users to whatever security groups that are required. That way, if your TS gets compromised, your main domain admin is not compromised, at least not necessarily.

VPN is also an additional layer of security you may want to add.

share|improve this answer

The Linksys RV042 router appears to support termination of VPNs. Why not simply require your clients to establish a VPN to the router first?

Of if that setting up a VPN on the router is not an option, setup another server on your network that can terminate a VPN. It sounds like you don't really need a full vpn, even a simple SSH tunnel may be enough.

share|improve this answer
Thanks. We use VPN already, but VPN is flaky for Macs and slow for all (the Internet options in LA are terrible). – Justin Nov 2 '09 at 19:48

The best you can do is to enable Network Level Authenticaiton (NLA) on each of the servers, which would require the user enter a username/password before connecting and can be configured via GPO.

To achieve the effect you're after, there might be a way to manipulate the expiration time for a particular users' Kerberos ticket given to them by Active Directory after logging in. If not, you could create a separate/special user-account that has it's password periodically changed by a script somewhere; then you could require users to "log in" to a little web-app somewhere that gives them the latest password when desired.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.