Security and Permissions with Remote Desktop Windows Server on Web Host

Question

I am configuring a Windows web server on a remote host. Obviously I need to use terminal services, but what can I do to make it as secure as possible. The Hosting company also needs access to the server when there are issues and so I need to provide access to them as well.

1-What can I do in general to minimize chances of unauthorized access.

2-How should I handle the permissions for the hosting company's access? Should user "admin" not be used?

Answer 1

1 - Put it behind a VPN or if someone has SSH access to a box on the local network that is trusted, setup a simple SSH tunnel so that RDP can be accessed through the tunnel. Either option means you won't be passing any credentials in the open, and that's a good thing.

2 - Don't give them administrative access if they don't need it. Give them a degraded user login (without administrative privileges) if at all possible.

Answer 2

1. My recommendation would be to put it behind a firewall with VPN access.

2. As a best practice "admin" "root" or "administrator" shouldn't be used over any external connection that isn't properly encrypted