RDP Security

Remote Desktop Commander v4.9 Now Available!

June 12, 2020 By admin Leave a Comment

Greetings friends and current Remote Desktop Commander customers! We’ve just released Version 4.9 of the Remote Desktop Commander Suite and our Premium Management Features overlay. This new version offers:

brand new reports that track things like RDP loss and retransmission rates, hourly load on servers, user reconnection attempts through a Remote Desktop Gateway, and much more;
an overhaul of our existing reporting, with a focus on better chart presentation and automatic chart data aggregation in larger environments;
the ability to delegate out management tasks and shadowing to Citrix help desk staff members, allowing them a much more streamlined shadowing experience that does not require the use of Citrix Director or Microsoft Remote Assistance;
numerous other product enhancements.

We’re also excited to announce that we’re expanding an existing promotion which you won’t want to miss, so please read on!

In this RDPSoft E-Newsletter:

New Reports Available in the Remote Desktop Commander Suite

Existing Report Improvements

Management Delegation Wizard and SuperShadow Now Available For Citrix Admins and Help Desk Staff

Other Product Enhancements in Version 4.9

Expanded Promotion – Buy Andy’s Book on RDS Security, and Get 1 Month of Remote Desktop Commander Suite AND Remote Desktop Canary Monitoring For Free

Version 4.9 Upgrade, Purchase, and Demo Links

New Reports in the Remote Desktop Commander Suite

RDP Protocol Loss and Retransmission Rates

Quickly spot the client users with the highest rates of UDP packet loss

Now that *almost all* of the Remote Desktop Services deployments running Server 2008 R2 have been retired, it remains important to keep an eye on aspects of how the modern Remote Desktop Protocol is functioning in your Server 2012, 2016, and 2019 environments. A key part of that is detecting packet loss and retransmission rates over the UDP channel used by RDS. Version 4.9 of the Remote Desktop Commander Suite now offers two new reports (a detailed variant and a summary variant) that quickly show you which users are suffering the highest rates of packet loss and retransmission. Coupled with other network quality reports like latency, you can quickly spot clients with less reliable connections.

Performance – Hourly Load By Server

Even without our agent installed, you can get daily reports showing how CPU, memory usage, and session counts increased and decreased during certain hours of the day.

Long time users of our Remote Desktop Commander Suite are well familiar with our Historical and Performance Across the Load dashboard. Now this same data is available in report form, either on-demand when working inside this dashboard, or as a report that can be scheduled on a recurring basis. For organizations running RDS, Citrix, and WVD deployments in a public cloud like Azure or AWS, having this information is critical, as it makes sure you’re not wasting your compute dollar as server load waxes and wanes throughout different days of the week.

Remote Desktop Gateway Reconnection Attempts

Similar to its sister report, Session Reconnect Attempts, the new Gateway Reconnect Attempts highlights users that have reconnected through a Remote Desktop Gateway more than 2 times in any hour. This may be indicative of connection issues on their part or, if many users are reconnecting frequently in the same hour, it may be highlighting a load issue on the Gateway or a general misconfiguration in the broader RDS deployment.

Existing Report Improvements

During the Version 4.9 development cycle, we spent a great deal of effort cleaning up the 100 reports in the Remote Desktop Commander Suite, specifically reports that utilize charts.

In previous versions of the Remote Desktop Commander Suite, certain charts could be become unreadable if the volume of data (e.g. the number of user accounts) was too large. While this was easily remedied by pairing the reports with filters that restricted data by computer name, Active Directory group, or user account, we have now added automatic “Top X” and “Bottom X” aggregation to some of the reports. If you have a larger environment with many different users, the charts will automatically show you the outliers (e.g. the Top 15 users with the highest average RDP latency for instance). For example:

“Top X” style aggregation now allows you to spot outliers and makes reports cleaner in larger environments. Here you can see the users with the highest and lowest productivity.

All of this aggregation is automatic so, after you upgrade to Version 4.9, you’ll start seeing it automatically in most of the reports that you typically run on a scheduled basis.

Delegation of Management AND SuperShadow Functionality Now Supported For Citrix Deployments

Our Management Delegation Wizard and SuperShadow features for RDS and Windows Virtual Desktop have been such a hit, and we now support those features in Citrix environments as well. At only $99.99 per named admin, help desk, or manager user per year, it’s quite the bargain!

We’ve heard more recently from many Citrix admins that attempting to delegate out specific management tasks like logging off users, disconnecting users, and shadowing users to help desk and other non-admin staff is painful at best. In some cases, being able to assign that level of granularity via Custom Roles in Citrix Studio is unavailable unless you are an Enterprise customer.

Then, there are issues with shadowing in Citrix Director itself. Currently, shadowing in Director leverages Remote Assistance, which must be installed and configured correctly on the administrator’s system to work correctly. It also informs the target Citrix user of the shadowing attempt. In some industries, the ability to monitor one or more worker sessions for spot auditing and compliance without user notification is required.

Fortunately, our Premium Management Features overlay now solves this big gap for all Citrix deployments, regardless of licensing level. Specific groups of help desk users can quickly be delegated specific management tasks, without being made admins on the host servers. Also, shadowing can be configured with or without consent required. More importantly – it just works. SuperShadow launches and can monitor and manage multiple user sessions at once from different Citrix hosts, whether they are desktop or app sessions, and whether or not the client is using multiple monitors. It all works natively, and is not dependent on Remote Assistance at all.

In three quick steps, you can unify and delegate Citrix management permissions to your help desk staff and other non-admin managers

Select (check) the Citrix sessions from the Virtual Apps and Desktops host servers, and then shadowing is just another mouse click away. No dependencies on Remote Assistance required.

Other Product Enhancements

Here are two other product enhancements in Version 4.9:

Loading speed has been improved in the Performance and Load Across the Farm Dashboard, especially for larger environments.
A “Test Email” button has been added in the Remote Desktop Commander Configuration tool, to quickly verify whether or not scheduled reports can relay properly.
We now support the usage of a Service Principal Name (SPN) to authenticate against and manage WVD deployments.

Expanded Promotion – Buy Andy’s RDS Security Book and Get A Month of Monitoring For Free!

Andy’s new RDPwned book on Securing Remote Desktop Services was a hit at launch, with lots of readers sharing their positive feedback with him. When the book launched, we started a promotion whereby any person who purchased the book could pick up a single server’s worth of RDS monitoring via the Remote Desktop Commander Suite for a full month. Now, we’re pleased to extend this promotion further.

If you purchase RDPwned between now and July 31st, 2020, we’ll give you a one month, single server monitoring license of the Remote Desktop Commander Suite, AND a single workflow license of Remote Desktop Canary, so you can get alerted if any problems whatsoever start to develop in one of your RDS collections. That’s a $70 USD value for only $9.99!!

All you need to do to claim your 1 server, 1 month Remote Desktop Commander Suite license and your 1 workflow, 1 month Remote Desktop Canary License is to email inquiries [at] rdpsoft [dot] com with a screenshot of your Amazon Kindle purchase receipt. We’ll take care of the rest!

Remote Desktop Commander 4.9 Upgrade, Purchase, and Demo Links

If you are an existing Remote Desktop Commander SUITE subscription licensee and/or active maintenance agreement holder, click here to request upgrade instructions.

If you are an existing Remote Desktop Commander Lite or Premium Management Features customer, proceed to the Remote Desktop Commander Lite download page to download Version 4.9 of the client. Then install it over your previous version.

If you’d like to learn more about the Remote Desktop Commander Suite, including its feature set and how to start a subscription for only $9.99 per server per month, click here.

Request a web demo with an RDPSoft solutions expert to see all our solutions’ features in depth.

RDPwned: A Guide To Securing Microsoft Remote Desktop Services

April 7, 2020 By Andy Milford Leave a Comment

Greetings, friends and loyal customers! After over a year of research, my new book on how to secure your RDS environments has finally been published.

RDPwned - A Guide to Securing Microsoft Remote Desktop Services — Click here to purchase the Amazon Kindle edition for only $9.99 USD

Given how many of you are standing up new Remote Desktop Services deployments or expanding existing ones right now to facilitate teleworking during the COVID-19 outbreak, it’s imperative that you get serious about RDS security. Hackers and APT (Advanced Persistent Threat) teams know that businesses around the world are “opening up their doors wide” to facilitate remote working at the moment, and they may come knocking at yours soon. Don’t unwittingly let them in.

My book first walks you through how attackers find your RDS deployments, using normal search engines and device fingerprinting search engines like Shodan. Then I show you the tools hackers use to break into your environment, by performing dictionary attacks, man-in-the-middle compromises, or client-side credential stealing. Next, I illustrate some of the most common techniques and scripts they will use to escalate their privileges from a lowly standard user all the way up to local admin and domain admin, and how they are able to deploy and run these scripts and malware on your servers. Finally, I discuss the major types of defenses you can deploy to reduce the likelihood of being attacked, and how to mitigate the damage if you are.

An Exclusive Offer Through December 2020

As a way of saying thanks to all users of RDPSoft software who wish to purchase this book, we’ve crafted a special promotion:

All individuals and companies that purchase a copy of my new book – just $9.99 on Amazon Kindle – through the end of December 2020 are also entitled to 1 server license of our Remote Desktop Commander Suite software for a month.

What can you do with a license of our Remote Desktop Commander Suite for a month? Here are a few ideas:

All you need to do to claim your 1 server, 1 month Remote Desktop Commander Suite license is to email inquiries [at] rdpsoft [dot] com with a screenshot of your Amazon Kindle purchase receipt.

Track RDP Hack Attacks With RDS Log Viewer 2.0

October 11, 2018 By admin Leave a Comment

For many, the first time the threat of RDP hack attacks became real was when in September of 2018, the FBI and Department of Homeland Security issued a Public Service Announcement on the proliferation of hacking and ransomware attacks taking place via the Remote Desktop Protocol. Here are some key takeaways from that announcement:

Remote administration tools, such as Remote Desktop Protocol (RDP), as an attack vector has been on the rise since mid-late 2016 with the rise of dark markets selling RDP Access. Malicious cyber actors have developed methods of identifying and exploiting vulnerable RDP sessions over the Internet to compromise identities, steal login credentials, and ransom other sensitive information.

CrySiS Ransomware: CrySIS ransomware primarily targets US businesses through open RDP ports, using both brute-force and dictionary attacks to gain unauthorized remote access. CrySiS then drops its ransomware onto the device and executes it. The threat actors demand payment in Bitcoin in exchange for a decryption key.

Dark Web Exchange: Threat actors buy and sell stolen RDP login credentials on the Dark Web. The value of credentials is determined by the location of the compromised machine, software utilized in the session, and any additional attributes that increase the usability of the stolen resources.

Enable logging and ensure logging mechanisms capture RDP logins. Keep logs for a minimum of 90 days and review them regularly to detect intrusion attempts.

Years later, and with many more using RDP for every day business, if you haven’t been keeping tabs on RDP access attempts into your network or Azure cloud environment, it’s time to start.

Remote Desktop Commander Suite v4.5+ Features: Audit and Visualize All RDS Login and Logon Failure Activity

Consolidate All RDS Logins and Logon Failures, Regardless
Of Whether Or Not They Occurred On Session Hosts Or Remote Desktop Gateway Servers

Attempting to track successful RDP logins is no picnic, as multiple log files from multiple different systems – the session host servers and remote desktop gateway servers – must be consulted and the information correlated.

In version 4.5+ of the Remote Desktop Commander Suite, the Remote Desktop Reporter Service automatically collects and correlates key events from event log files on Session Host servers and Remote Desktop Gateway servers. The result is a treasure trove of valuable login and logon failure data that it retains in its SQL database, allowing us to deliver the incredible new features described below.

Find Out Where Your Users Are Working From, and Locate the Source Of Potential Brute Force RDP Hacks

Geolocate RDP Logon Failures — Perform deep analysis of RDP logon failures and user logins using the User IP Geolocation Dashboard.

Remote Desktop Services login and logon failure data correlation from session hosts and gateways is a valuable feature in its own right, but the rich visualizations of this data is what sets Remote Desktop Commander Version 4.5+ apart from the competition. The User IP Geolocation Dashboard combines IP geolocation data with interactive worldwide maps and tabular, filterable tables so administrators can zero in on both legitimate RDS users and hackers.

Locate The Source of RDP Brute Force Hack Attempts — Filter RDP logon failure and login data by username, time frame, computer, and sort the data by username, region, country etc.

Our dashboard is completely extensible via PowerShell scripts, which are designed to receive selected server names, usernames, and IP addresses as input parameters. This is especially useful for the remediation of inbound hack attempts.

Remediate Brute Force RDP Attacks — Extend the capabilities of the dashboard with PowerShell

Instantly build reports from the filtered RDP login and logon failure data in the dashboard, or simply export the data to comma-delimited text.

Report on RDP Logon Failures — Export RDP login data and generate reports in PDF, Word, or Excel.

Schedule Daily User Login and Logon Failure Reports

RDP Logon Failure Reports — Build RDP login reports manually, or schedule them to run daily to gain insight on where users are connecting from.

With routine review of these reports, you can quickly spot geographic RDP login anomalies that could be suggestive of a compromised user account.

See The Actual IP Address and Geolocation Information for User Sessions In Existing Time Tracking Reports

By default, the Microsoft Terminal Services client (MSTSC) does not report its actual global IP address when connecting to a terminal server. And, when connecting through a Remote Desktop Gateway system, no IP address information is transmitted at all. Many admins requested that we transform the incorrect or missing IP address information with the actual global IP address of the user, whether or not they are connecting through a RD Gateway.

Based on this feedback, we retrofitted several existing reports, such as the User Sessions – Session Details By User report family, to include the correct global IP of the user based on the correlated log data now collected by our central polling service. Also, when possible, the global IP address is accompanied with the geographic region of the user’s ISP

Remote Desktop User Time Tracking Report — Many existing user activity reports now include the resolved, Global IP of the user, and ISP geolocation information when available.

RDS Log Viewer 2.0+ Featuring Remote Desktop Gateway Login and Logon Failure Tracking

Our RDS Log Viewer 2.0+ has the ability to track RDS connections through a Remote Desktop Gateway Server, and it will also show you some of the logon failures on your Remote Desktop Gateway. This is useful for several reasons:

- You can see what IP addresses your users are connecting from through your RD Gateway server, to see if there are significant discrepancies in source IP. You can manually geolocate these IP addresses if you want. A user account that connects through the gateway using IP addresses from ISPs in different regions may be compromised.

- You can view the first 30 logon failures from your Gateway server. If you see user accounts that are not part of your domain in the initial list of failures, your RD Gateway may be experiencing repeated brute force attacks. You can investigate further by starting a subscription to our Remote Desktop Commander Suite, which has the ability to track all logon failures and puts you in a position to fix the problem.

Next Steps . . .

Learn more about the Remote Desktop Commander Suite, including its feature set and how to start a subscription.

Or, to download RDS Log Viewer v2.0, please click here.

And, if you’re not sure where to go next, request a web demo with an RDPSoft solutions expert to see all our solutions’ features in depth.

Updated: November 2020.

RDS Logins & Logon Failure Tracking (And More) in Remote Desktop Commander v4.5+

September 27, 2018 By admin Leave a Comment

Though later versions of our Remote Desktop Commander Suite build on these key features, it’s worth drilling into these specific capabilities in RDS logins and logon failure tracking (plus some extra stuff we’re sure will interest you) that were introduced starting with v4.5:

Consolidate All RDS Logins and Logon Failures, Regardless Whether Or Not They Occurred On Session Hosts Or Remote Desktop Gateway Servers

Our CEO, Andy Milford, has written at length about the challenges faced when attempting to correlate RDP logon failure data from session hosts at his PureRDS.org blog. Attempting to track successful RDP logins is no picnic either, as multiple log files from multiple different systems – the session host servers and remote desktop gateway servers – must be consulted and the information correlated.

In version 4.5 of the Remote Desktop Commander Suite, the Remote Desktop Reporter Service automatically collects and correlates key events from event log files on Session Host servers and Remote Desktop Gateway servers. The result is a treasure trove of valuable login and logon failure data that it retains in its SQL database, allowing us to deliver the incredible new features described below.

Geolocate RDS Logins and Logon Failures In the User IP Geolocation Dashboard – Find Out Where Your Users Are Working From, and Locate the Source Of Brute Force RDP Hack Attempts

Instantly build reports from the filtered RDP login and logon failure data in the dashboard, or simply export the data to comma-delimited text.

Schedule Daily User Login and Logon Failure Reports

Scheduled reports make it easy to keep track of both where your users are routinely connecting from, as well as the sources of hacking and penetration attempts. Group login and logon failure data by country or by user. With routine review of these reports, you can quickly spot geographic RDP login anomalies that could be suggestive of a compromised user account.

See The Actual IP Address and Geolocation Information for User Sessions In Existing Time Tracking Reports.

By default, the Microsoft Terminal Services client (MSTSC) does not report its actual global IP address when connecting to a terminal server. When connecting through a Remote Desktop Gateway system, no IP address information is transmitted at all. Many admins have requested that we transform the incorrect or missing IP address information with the actual global IP address of the user, whether or not they are connecting through a RD Gateway.

Based on this feedback, we have retrofitted several existing reports, such as the User Sessions – Session Details By User report family, to include the correct global IP of the user based on the correlated log data now collected by our central polling service. Also, when possible, the global IP address is accompanied with the geographic region of the user’s ISP

Massively Reduce Database Storage Requirements With Performance Threshold Database Pruning

As you can see, we’ve mainly talked about logins and logon failures so far, and we’re talking about lots of data that we work with. So, we have to be ready to handle it all. Which brings us to a related feature.

Collecting in-depth performance data on a per-user and per-program basis with our agent service is great, but it’s easy to generate a lot of data in SQL by doing so. Version 4.5+ has a nifty new feature that we call “Performance Threshold Database Pruning.”

Now, in addition to purging out agent-based performance data based on date, you can elect to keep only the agent data associated with times of high load on session host servers. You can define what you consider to be high load both in terms of CPU usage or memory utilization, or a combination of both. Using this new feature can drastically reduce the amount of data stored in SQL over time, in many cases by over 80%.

Control RDS Performance Database Growth — Using Performance Threshold Database Tuning, tightly control the size of your SQL database growth.

. . . And What’s The Latest?

Of course, features change and mature, so be sure to find out the latest developments with our Remote Desktop Commander Suite by requesting a web demo with an RDPSoft solutions expert.

Updated: November 2020.

RDPwned: A Guide To Securing Microsoft Remote Desktop Services

An Exclusive Offer Through December 2020

From the RDPSoft Blog

SPLA Reporting Made Easy

Reach Out

In this RDPSoft E-Newsletter:

New Reports in the Remote Desktop Commander Suite

RDP Protocol Loss and Retransmission Rates

Performance – Hourly Load By Server

Remote Desktop Gateway Reconnection Attempts

Existing Report Improvements

Delegation of Management AND SuperShadow Functionality Now Supported For Citrix Deployments

Other Product Enhancements

Expanded Promotion – Buy Andy’s RDS Security Book and Get A Month of Monitoring For Free!

Remote Desktop Commander 4.9 Upgrade, Purchase, and Demo Links

An Exclusive Offer Through December 2020

Remote Desktop Commander Suite v4.5+ Features: Audit and Visualize All RDS Login and Logon Failure Activity

Consolidate All RDS Logins and Logon Failures, RegardlessOf Whether Or Not They Occurred On Session Hosts Or Remote Desktop Gateway Servers

Find Out Where Your Users Are Working From, and Locate the Source Of Potential Brute Force RDP Hacks

Schedule Daily User Login and Logon Failure Reports

See The Actual IP Address and Geolocation Information for User Sessions In Existing Time Tracking Reports

RDS Log Viewer 2.0+ Featuring Remote Desktop Gateway Login and Logon Failure Tracking

Next Steps . . .

Consolidate All RDS Logins and Logon Failures, Regardless Whether Or Not They Occurred On Session Hosts Or Remote Desktop Gateway Servers

Geolocate RDS Logins and Logon Failures In the User IP Geolocation Dashboard – Find Out Where Your Users Are Working From, and Locate the Source Of Brute Force RDP Hack Attempts

Schedule Daily User Login and Logon Failure Reports

See The Actual IP Address and Geolocation Information for User Sessions In Existing Time Tracking Reports.

Massively Reduce Database Storage Requirements With Performance Threshold Database Pruning

. . . And What’s The Latest?

From the RDPSoft Blog

SPLA Reporting Made Easy

Reach Out

Consolidate All RDS Logins and Logon Failures, Regardless
Of Whether Or Not They Occurred On Session Hosts Or Remote Desktop Gateway Servers