When using Remote Desktop Connection, is the information being sent back and forth securely, as in SSL? Are usernames and passwords secure? When connecting to a remote server through Remote Desktop Connection, is the server required to use, at minimum, a self-signed ssl certificate in order to secure the data sent back and forth? I'm simply wanting to know if my info going through Remote Desktop Connection is secure or not. I'm connecting from a Win7 PC to a Windows 2008 R2 Web Server. Thanks for your help!


by default the connection is SSL encrypted with a self signed cert. you should et a warning on first connection or optionally on every connection about this. You can use a signed cert if paranoid.

  • This specific feature is only available on Server 2003 x64, Vista, and newer. Also, I believe the XP RDC client lacks the ability to verify even if connecting to newer computers so every connection can be at risk. – penguin359 Apr 7 '11 at 22:43
  • 1
    And in the original question, the poster mentioned he was connecting from Win7 to Server 2008 R2 which should be fine. – Ryan Bolger Apr 7 '11 at 23:19
  • Yes Chris while a lot of this historical information is interesting, it's not relevant to your scenario. IF you're just interested in Win7 talking to 2008R2 then TLS 1.0 SSL is the default and plenty secure, and ollybee's answer is correct. – Bret Fisher Apr 8 '11 at 0:13

RDP can use RC4 128-bit encryption. From what I gather, RC4 is not considered as strong as AES for the same key-length, but I'm no cryptographer. This feature has been present since XP, but it is not required. The default group policy allows for minimal or no encryption for compatibility. Unfortunately, until Server 2003 SP1, while it was encrypted, there was no authentication of the connection because it used a hardcoded private key. (I'm not referring to the login prompt once a connection has been established, but during the connection attempt.) This means that you can't be sure that you are actually talking to the real RDP server. You could be subject to a man-in-th-middle attack where you have just negotiated an encrypted connection with some malicious third-party who is decrypting everything and then re-encrypting it to send to the real server. This can only happen on initial contact. If you actually did connect and negotiate encryption with the real server, you are safe, at least until to try and connect again. Starting with Server 2003 SP1 and Vista, TLS was added and a certificate is generated automatically used to sign the connection handshake. You still need to learn what the certificate is, but it can be stored to verify future connections. Ideally, the certificate will be signed by the in-house CA for your domain, but lacking any PKI, you may still be subject to man-in-the-middle on the very first connection unless you verify the fingerprint.

  • To add to that; RC4 is not "safe" these days. Due to its use in WEP Wifi encryption, a lot of time and energy has been put into developing better attacks against RC4's mathematical flaws. For the same reasons that WEP is a very bad idea these days, so is anything on RC4. – Shane Madden Apr 7 '11 at 22:51
  • 2
    @Shane WEP was also a bad implementation of RC4, it not entirely RC4's fault when one used only a 40-bit key and 24-bit seed. But, RC4 is getting a little old now. – penguin359 Apr 7 '11 at 22:53
  • Oh, I should add this article: mobydisk.com/techres/securing_remote_desktop.html – penguin359 Apr 8 '11 at 0:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.