1

We have a server that we want our users to be able to remote into from within the office, but only a -few- (administrators) should be able to login from outside the office.

Currently, anyone who can remote into the desktop, has the ability to remote in from outside the office.

Is there a way to restrict remote desktop permissions by source of login?

Improve this question
0

4 Answers 4

Reset to default
1

We use a login script to check the connecting computer name and if it doesn't match the list we deny the connection. We exclude some users from this check so they're always able to connect, whether in the office or not. So you simply add a line for each office computer (or authorized computer) and add a line for every user you want to exlude from the check. Below is a sample from the script:

IF %USERNAME% == joeschmoe GOTO OK

IF %USERNAME% == janedoe GOTO OK

IF %CLIENTNAME% == OfficeComputer1 GOTO OK

IF %CLIENTNAME% == OfficeComputer2 GOTO OK

IF %CLIENTNAME% == OfficeComputer3 GOTO OK

REM The following message is displayed on computers not authorized to connect.

msg * You are not authorized to login from this location. You will be logged off in 10 seconds.

sleep 10 LOGOFF

:OK EXIT

Improve this answer
2
  • While maybe not the most secure since all they have to do is change their personal computers name to Office1 for instance, this is a potential idea.
    – Brett Allen
    Feb 9, 2011 at 16:10
  • It's not meant to be a security mechanism in the traditional sense of "security". It's simply meant to restrict who can log on via RDP from which computer. In addition, it's a pretty far leap to presume that the user will: A. Deduce what mechanism you're using to restrict their access. B. Put 2 & 2 together and deduce that by changing their home computer name to match their work computer name they'll be able to circumvent this restriction. We've used this for 5 years and haven't to this point had a user figure it out and circumvent it.
    – joeqwerty
    Feb 9, 2011 at 16:20
1

Consider investigating IPSec which if I understand it correctly can be used to restrict access based on a combination of rules including network location, client machine identity (assuming it's a member of the domain), and user credentials. So you could theoretically set up an IPsec policy allowing only Admins on certain computers to access RDP from outside the office network. If you make use of Group Policies, you could easily apply the rules to any additional servers you wish to set up in the same way.

Improve this answer
1

Setup a Terminal services gateway. You can set up policies on ehat different groups are allowed to access. Only permitbremote access via the gateway.

Improve this answer
0

Not by permissions. You could use the OS firewall to deny all external IP's port 3389 access and allow only certain external IP's (if you know them and they are static). Another option would be to deny all external IP's on you core FW and then only allow RDP if they VPN in to your network.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .