Configuring Firewall Rules for RDP Access
The most effective way to control who can initiate an RDP session is through the Windows Defender Firewall advanced settings. This method operates at the network layer, blocking connection requests before they reach the authentication subsystem. You should never rely on disabling services viaservices.msc to reject clients, as this stops the service entirely rather than filtering users. Instead, use firewall rules to allow only trusted sources.
Open the Windows Defender Firewall with Advanced Security console from the Server Manager or Start menu. Navigate to Inbound Rules and locate the rule named Remote Desktop - User Mode (TCP-In). Right-click this rule and select Properties. In the Scope tab, under the Remote IP addresses section, choose These IP addresses. Click Add and enter the static IP addresses or subnets of the machines from which administrators are allowed to connect. For example, if your office network uses the subnet 192.168.1.0/24, add that range here. Ensure that all other entries in this list are removed to prevent any other IP from accessing RDP. Repeat this process for any additional RDP-related inbound rules if present, ensuring consistency across your firewall policy.
Restricting VPN Connections via Network Policies
For VPN connections, particularly those using Routing and Remote Access Service (RRAS), restriction is handled through Network Policy Server (NPS) policies if NPS is deployed, or directly within the RRAS configuration. If you are using a standard L2TP or SSTP VPN setup, you can limit access by configuring user permissions and network constraints. Access the Routing and Remote Access console in Server Manager. Expand your server node and navigate to IP > IPv4. Right-click IPv4 and select Properties. Under the Advanced tab, ensure that Enable IP address assignment is checked if you are assigning IPs dynamically, but more importantly, look at the Authentication Provider settings. If you are integrating with Active Directory, ensure that only specific groups have dial-in permission. To do this, open Active Directory Users and Computers, find the user or group intended for VPN access, right-click, and select Properties. Go to the Dial-in tab and explicitly set the option to Allow access or Deny access. This granular control ensures that even if a VPN tunnel is established, the user cannot authenticate without explicit permission. Additionally, consider implementing IPsec filters to further restrict the types of traffic allowed over the VPN tunnel, adding another layer of defense.Enforcing Group Policy Restrictions
Group Policy provides a centralized way to enforce security standards across multiple servers. While firewall rules handle network-level access, Group Policy can restrict local login rights and enforce strong authentication methods. Open the Group Policy Management Console and create a new policy linked to the Organizational Unit containing your server accounts. Navigate to Computer Configuration > Windows Settings > Security Settings > Local Policies > User Rights Assignment. Locate Allow log on through Remote Desktop Services and remove any generic groups like "Users" or "Everyone". Add only specific administrative groups such as "Domain Admins" or a custom "Remote Admins" group. This ensures that even if a firewall rule is bypassed or misconfigured, the local security policy will deny the login attempt. Furthermore, enable Network Security: Restrict NTLM: Outgoing NTLM traffic to remote servers to mitigate relay attacks that could compromise RDP sessions.Monitoring and Auditing Connection Attempts
Restricting access is only half the battle; monitoring these attempts is crucial for detecting potential breaches. Enable auditing for successful and failed logons in the Local Security Policy under Audit Policy > Logon/Logoff. Configure the Event Viewer to forward critical security events to a central log management system. Look for Event ID 4625, which indicates a failed logon attempt, and Event ID 4624 for successful logons. By analyzing these logs, you can identify patterns of brute-force attacks or unauthorized access attempts from blocked IP ranges. Regularly review these logs to adjust firewall rules and group policies as your network topology changes. This proactive approach helps maintain the integrity of your restricted access controls and ensures that only authorized personnel can interact with your Windows Server 2022 environment. For more details on securing remote access channels, see Secure Your Remote Access with L2TP Tunnel for Windows PC and How to Allow Group IPs on a Single NIC in Windows Server 2022 for Exclusive Access.Frequently Asked Questions
Can I disable the Remote Desktop service to block all RDP?
Yes, you can disable the Remote Desktop Services via services.msc to completely stop RDP, but this breaks legitimate access for all users. It is better to use firewall rules to restrict access by IP while keeping the service running for authorized administrators.
What happens if I forget my admin IP when restricting RDP?
If you lock yourself out by setting strict firewall rules, you may need physical access to the server or use a rescue console to revert the changes. Always keep a backup rule allowing your own IP or test changes during maintenance windows.
Does restricting RDP affect VPN throughput?
No, restricting RDP access does not impact the performance or throughput of your VPN connections. These are separate protocols handled by different firewall rules and authentication mechanisms.
How do I allow a dynamic IP for a remote administrator?
You cannot easily use dynamic IPs in static firewall rules. Consider using a DNS-based solution or a VPN client that connects first, then allows RDP through the secure tunnel, rather than exposing RDP directly to the internet.
Is it safe to leave RDP enabled on port 3389?
Leaving RDP on port 3389 exposed to the internet is unsafe due to brute-force risks. Always restrict access via firewall rules to specific IPs and use Network Level Authentication (NLA) to require authentication before the desktop loads.