I want to make sure that administrative access to Windows domain controllers are allowed only from specific IP addresses.

Note: I mean not only RDP access but ANY port/protocol that allows administrative access: SMB, WMI, LDAP, ADSI, etc.

Most of these ports on DCs are exposed to client computers by default. Thus I cannot put IP filters to block them.

I need a user/group based solution that allow admin logon only from some specific IP range.

What is the best way to do it?

The only idea I have is to make a script checking for some login events in real-time and killing unwanted connections. This is not very elegant and does not guarantee instant blocking.

This should be a very common issue in big networks and multi-tenant environments.

Is there any better idea?

  • 2
    That's what firewalls are for. – Gerald Schneider Sep 15 '18 at 6:12
  • Firewalls can't be used as regular clients need these ports too. – coder56 Sep 15 '18 at 6:21
  • They don't need RDP, they don't need remote management, everything in that category can and should be shut off with a firewall. The protocols that are needed for client authentication are already handled by permissions. – Gerald Schneider Sep 15 '18 at 6:28
  • Restricting RDP is easy and it is not exposed to users by default. I need to restrict other ports/services that are exposed to any AD user: SMB, LDAP, ADSI. I does not matter how strong my RDP controls are if the same admin password can used to take control of the forest via any of these ports. – coder56 Sep 15 '18 at 6:34
  • To the best of my knowledge, what you're trying to do isn't possible, Windows simply doesn't support it. Good idea though, and I could be wrong. +1. – Harry Johnston Sep 17 '18 at 2:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.