2

I'm following this page on security tips for RDP (for my online server):

http://www.mobydisk.com/techres/securing_remote_desktop.html

Now I don't have a special user account for RDP access. Just the administrator can log on. However, I want to make sure that someone can't brute force the password.

I've set the 'account lockout policy' to 3 attempts and a retry after 3 minutes. However, when I connect back with RDP I can still try 5 times before RDP breaks the connection. I can then immediately reconnect and try 5 more times.

Any ideas if there is a lockout policy which also holds true fro the admin?

  • 1
    Many people handle this by simpling renaming the Administrator account. Yes it is a bit of obscurity-based-security, but it may help a little. After you rename you could create a un-privileged account with the name administrator. – Zoredache Feb 23 '11 at 16:28
  • ok..so I create a new user and give admin rights and configure a proper lockout, and the real admin I just rename into something weird so it can't be guessed? – reinier Feb 25 '11 at 13:29
2

You don't want to setup a lockout policy for your only Admin user.

Reason being: You create a major security hole in your setup as an attacker could prevent your access by simply continuously brute forcing against your admin access (a.k.a. The other side of account lock-out).

The best options are:

  • Restrict RDP to specific IP sources;
  • Rename the Administrator user

You don't list your Windows Version but here's how to do it on Windows 2003 and 2008.

Note: You can also use GPO to rename the account across multiple machines

  • Your point about the denial of service could apply to any account, not just the built-in Administrator account, which really should not be used on a regular basis. – Greg Askew Feb 18 '13 at 12:36
  • Sure thing... but the person would have to enumerate the username first, which on a system with only RDP exposed to external parties is not trival - except if you allow that cute "known users" feature to run via RDP. The issue with Administrator/root (and to be fair with any other default account) is that you know exists and as such the brute forcing is easier. This - the ability to enumerate valid users - is one of the reasons why login error messages should NOT differentiate between incorrect username or incorrect passwords (cwe.mitre.org/data/definitions/204.html) – Andre de Miranda Feb 18 '13 at 12:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.