I am a dev with little admin expertise, administering a single dedicated web server remotely.

A recent independent security audit of our site recommended that "RDP is not exposed to the Internet and that a robust management solution such as a VPN is considered for remote access. When used, RDP should be configured for Server Authentication to ensure that clients cannot be subjected to man-in-the-middle attacks."

Having read around a bit, it seems like Network Level Authentication is a Good Thing so I have enabled the "Allow connections only from Remote Desktop with NLA" option on the server today.

Is this acion enough to mitigate the risk of a Man-in-the-Middle attack? Or are there other essential steps I should be taking? If VPN is essential, how do I go about it?


You really should not have RDP open to the world, even with NLA on. NLA does cut down on MITM attacks, but if you are using the default self-signed certificate for RDP access, you're not all too secure.

One of the main reasons that you don't want to leave RDP open to the world is to prevent automated password cracking attempts. If you remove RDP from Internet-facing interfaces, you completely mitigate random, automated brute-force attacks. Putting something like a VPN in place for remote access is both highly recommended and useful.

There are many ways that you can implement a VPN. Windows has a built-in IPSEC VPN, for example. OpenVPN Access Server is also free for up to two concurrent users if you want to go the SSL VPN route.

If you need very specific instructions on how to set up a VPN, then you need to research the options, pick a technology, read the documentation, and then open a new question with any concerns or issues that you have implementing it. Just asking "How do I implement a VPN" is much too broad for Server Fault.


In the same way that a user can click right through an SSL warning in their browser, the avoidance of man-in-the-middle attacks is still the responsibility of the user.

All that this change has accomplished is to prevent the connection of older clients that don't support NLA (and the server identity validation that that provides).

For RDP version 6 clients, they're no more and no less vulnerable to an attack as they were yesterday - a user clicking through a server identity dialog box is all that needs to happen for a man-in-the-middle attack to be successful.

  • You're really only preventing Windows 2000 clients anyway, by turning NLA on. Windows XP SP3 can be made to use CredSSP with a couple of minor (and supported) registry tweaks. – MDMarra Nov 22 '11 at 16:56
  • @MarkM Good point. – Shane Madden Nov 22 '11 at 17:01

No, NLA is designed to minimize the attack surface of the Remote Desktop server. The man-in-the-middle protection occurs when you configure your Remote Desktop server connection with a valid certificate. However, if users dismiss the warning that appears if the server or certificate is not trusted or valid, they may still connect to an hostile Remote Desktop server, and that vulnerability has nothing to do with your Remote Desktop server.

Configure Network Level Authentication for Remote Desktop Services Connections

"Network Level Authentication completes user authentication before you establish a remote desktop connection and the logon screen appears. This is a more secure authentication method that can help protect the remote computer [remote desktop server] from malicious users and malicious software. The advantages of Network Level Authentication are:

"It requires fewer remote computer [remote desktop server] resources initially. The remote computer uses a limited number of resources before authenticating the user, rather than starting a full remote desktop connection as in previous versions.

"It can help provide better security by reducing the risk of denial-of-service attacks."

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.