We have a Windows Server 2008 Standard box running a terminal server that members of our team connect to from off-network locations via a firewall rule in our router (Linksys RV042) . For security reasons we have changed the default TS port to an unused high level port number.
We would like to add an additional layer of security that would be a username/password challenge unrelated to the terminal server and unrelated to the user's login credentials. I'm not sure this is even possible.
What I want to do here is like adding an Apache password challenge via a htaccess file on the wp-admin directory of a wordpress install, that has it's own login. So the first authentication mechanism is via a service that doesn't run the second authentication mechanism.
Any ideas how we might do this?