Office users access a win2003 server from within the office using thin clients and terminal services. In reviewing the security settings it seems, by default, all users in the 'Remote Desktop Users' group can access the server from outside the office, e.g from home.

We want make it by default that most users can only access the server from within the office, with another user group for the few who actually need external access.


You could block the external port 3389 on your firewall and require the users you'd like to be able to dial in remotely to use a VPN connection. This provides two layers of security, and only the users you want to have access externally would receive a VPN account. Once on the VPN connection, they could simply use the RDP client to connect to the terminal server.

  • 3
    +1 to firewall it off, add a VPN client to users who want to access from outside the intranet. Simplifies things. – Bart Silverstrim Jul 25 '11 at 20:24
  • Sounds good, but I would suggest taking a look at the Terminal Services Gateway service as well. This adds some additional security, and doesn't require much in the way of special configuration on the client side. It is very easy to setup ACLs about who can access what. – Zoredache Jul 25 '11 at 21:28
  • we changed the default port for ts access for starts. vpn is probably the long term solution. i think ts services gateway is only available on win2008 server. thanks for the comment.s – Robert McBean Jul 26 '11 at 22:21
  • It should be noted that only the gateway machine needs to be Server 2008, and not the terminal server itself. A VPN is likely a cheaper alternative as most firewalls have the capability built in already. – DKNUCKLES Jul 27 '11 at 12:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.