RDP Security

Greetings, friends and loyal customers! After over a year of research, my new book on how to secure your RDS environments has finally been published.

RDPwned - A Guide to Securing Microsoft Remote Desktop Services — Click here to purchase the Amazon Kindle edition for only $9.99 USD

Given how many of you are standing up new Remote Desktop Services deployments or expanding existing ones right now to facilitate teleworking during the COVID-19 outbreak, it’s imperative that you get serious about RDS security. Hackers and APT (Advanced Persistent Threat) teams know that businesses around the world are “opening up their doors wide” to facilitate remote working at the moment, and they may come knocking at yours soon. Don’t unwittingly let them in.

My book first walks you through how attackers find your RDS deployments, using normal search engines and device fingerprinting search engines like Shodan. Then I show you the tools hackers use to break into your environment, by performing dictionary attacks, man-in-the-middle compromises, or client-side credential stealing. Next, I illustrate some of the most common techniques and scripts they will use to escalate their privileges from a lowly standard user all the way up to local admin and domain admin, and how they are able to deploy and run these scripts and malware on your servers. Finally, I discuss the major types of defenses you can deploy to reduce the likelihood of being attacked, and how to mitigate the damage if you are.

As a way of saying thanks to all users of RDPSoft software who wish to purchase this book, we’ve crafted a special promotion. All individuals and companies that purchase a copy of my new book – just $9.99 on Amazon Kindle – through the end of May 2020 are also entitled to 1 server license of our Remote Desktop Commander Suite software for a month. What can you do with a license of our Remote Desktop Commander Suite for a month? Here are a few ideas:

All you need to do to claim your 1 server, 1 month Remote Desktop Commander Suite license is to email inquiries [at] rdpsoft [dot] com with a screenshot of your Amazon Kindle purchase receipt.

Greetings friends and current Remote Desktop Commander customers! We’ve just released Version 4.5 of the Remote Desktop Commander Suite. This new version has incredible new features focused around RDS security and Remote Desktop Gateway monitoring, so please read on!

In this RDPSoft E-Newsletter:

New Remote Desktop Commander 4.5 Features

RDS Performance Audits, Custom Report Design Work, Training, and White Glove Installation

Version 4.5 Upgrade, Purchase, and Demo Links

New features include:

Consolidate All RDS Logins and Logon Failures, Regardless Whether Or Not They Occurred On Session Hosts Or On Remote Desktop Gateway Servers
Geolocate RDS Logins and Logon Failures In the Brand New User IP Geolocation Dashboard – Find Out Where Your Users Are Working From, and Locate the Source Of Brute Force RDP Hack Attempts
Schedule Daily User Login and Logon Failure Reports, With Six New Reports To Choose From
See The Actual IP Address and Geolocation Information for User Sessions In Existing Time Tracking Reports
Massively Reduce Database Storage Requirements With Performance Threshold Database Pruning

Consolidate All RDS Logins and Logon Failures, Regardless Whether Or Not They Occurred On Session Hosts Or Remote Desktop Gateway Servers

Our CEO, Andy Milford, has written at length about the challenges faced when attempting to correlate RDP logon failure data from session hosts at his PureRDS.org blog. Attempting to track successful RDP logins is no picnic either, as multiple log files from multiple different systems – the session host servers and remote desktop gateway servers – must be consulted and the information correlated.

Andy created a free RDS Log Viewer tool in an attempt to tackle some of these problems. That initial research effort allowed RDPSoft to build a full log collection and correlation engine into the Remote Desktop Commander Suite.

In version 4.5 of the Remote Desktop Commander Suite, the Remote Desktop Reporter Service automatically collects and correlates key events from event log files on Session Host servers and Remote Desktop Gateway servers. The result is a treasure trove of valuable login and logon failure data that it retains in its SQL database, allowing us to deliver the incredible new features described below.

Geolocate RDS Logins and Logon Failures In the Brand New User IP Geolocation Dashboard – Find Out Where Your Users Are Working From, and Locate the Source Of Brute Force RDP Hack Attempts

Geolocate RDP Logon Failures — Perform deep analysis of RDP logon failures and user logins using the User IP Geolocation Dashboard.

Remote Desktop Services login and logon failure data correlation from session hosts and gateways is a valuable feature in its own right, but the rich visualizations of this data is what sets Remote Desktop Commander Version 4.5 apart from the competition. The User IP Geolocation Dashboard combines IP geolocation data with interactive worldwide maps and tabular, filterable tables so administrators can zero in on both legitimate RDS users and hackers.

Locate The Source of RDP Brute Force Hack Attempts — Filter RDP logon failure and login data by username, time frame, computer, and sort the data by username, region, country etc.

Our dashboard is completely extensible via PowerShell scripts, which are designed to receive selected server names, usernames, and IP addresses as input parameters. This is especially useful for the remediation of inbound hack attempts.

Remediate Brute Force RDP Attacks — Extend the capabilities of the dashboard with PowerShell

Instantly build reports from the filtered RDP login and logon failure data in the dashboard, or simply export the data to comma-delimited text.

Report on RDP Logon Failures — Export RDP login data and generate reports in PDF, Word, or Excel.

Schedule Daily User Login and Logon Failure Reports, With Six New Reports To Choose From

RDP Logon Failure Reports — Build RDP login reports manually, or schedule them to run daily to gain insight on where users are connecting from.

Scheduled reports make it easy to keep track of both where your users are routinely connecting from, as well as the sources of hacking and penetration attempts. Group login and logon failure data by country or by user. With routine review of these reports, you can quickly spot geographic RDP login anomalies that could be suggestive of a compromised user account.

See The Actual IP Address and Geolocation Information for User Sessions In Existing Time Tracking Reports.

By default, the Microsoft Terminal Services client (MSTSC) does not report its actual global IP address when connecting to a terminal server. When connecting through a Remote Desktop Gateway system, no IP address information is transmitted at all. Many admins have requested that we transform the incorrect or missing IP address information with the actual global IP address of the user, whether or not they are connecting through a RD Gateway.

Based on this feedback, we have retrofitted several existing reports, such as the User Sessions – Session Details By User report family, to include the correct global IP of the user based on the correlated log data now collected by our central polling service. Also, when possible, the global IP address is accompanied with the geographic region of the user’s ISP

Remote Desktop User Time Tracking Report — Many existing user activity reports now include the resolved, Global IP of the user, and ISP geolocation information when available.

Massively Reduce Database Storage Requirements With Performance Threshold Database Pruning

Collecting in-depth performance data on a per-user and per-program basis with our agent service is great, but it’s easy to generate a lot of data in SQL by doing so. Version 4.5 has a nifty new feature that we’re calling “Performance Threshold Database Pruning.”

Now, in addition to purging out agent-based performance data based on date, you can elect to keep only the agent data associated with times of high load on session host servers. You can define what you consider to be high load both in terms of CPU usage or memory utilization, or a combination of both. Using this new feature can drastically reduce the amount of data stored in SQL over time, in many cases by over 80%.

Control RDS Performance Database Growth — Using Performance Threshold Database Tuning, tightly control the size of your SQL database growth.

Schedule an RDS Performance Audit, Request Custom Reports, or Book Training and White Glove Software Installation/Reconfiguration

Ever since we launched them earlier this year, our Remote Desktop Services consulting offerings have been a hit. From White Glove installation of our software, to troubleshooting RDS performance problems, we’ve enjoyed working with admins across the globe to get their RDS environments optimized. Here’s a quick recap of what we offer – contact us to request more details and to obtain a professional services quote.

RDS Performance Audit

Administrator time is at a premium these days. Often, you may know there is a performance issue with your RDS farm, but you don’t have the time to figure it out on your own. Let RDPSoft do that for you. We will install our Remote Desktop Commander Suite software in your environment, and then gather up key performance metrics, including data from RDS-related event logs and installed Hotfixes. After gathering data for a week, we will build a comprehensive report that benchmarks performance in your farm and offers suggestions on how to improve it. You don’t even need to have your own instance of Microsoft SQL available for data collection – we can provide you with a secure connection to an Azure SQL database as part of this service. For more detailed information, and to request a quote, click here.

Custom Report Design

Do you need a report that’s not available out of the box? Let the RDPSoft team build that for you. Using the free Microsoft Report Builder tool, we can design custom SQL queries and RDLC templates that connect into our Remote Desktop Commander database. Click here for more information and to request a quote.

White Glove Installation

For only $99, an RDPSoft technician will establish a remote support session with you and install the Remote Desktop Commander Suite software. This service includes a.) installing the software, b.) linking it to a SQL Server Express, SQL Server, or Azure SQL database, c.) adding session hosts / workstations for monitoring, d.) verifying that data is being collected properly, and e.) verifying that the data is displayed properly in reports and the Remote Desktop Commander Client. Click here to purchase this service and schedule a time with an RDPSoft support expert.

Training and Other Professional Services

Did you know we also offer training on our products, custom PowerShell development to extend Remote Desktop Commander’s capabilities, assistance with adjusting permissions so non-admin help desks can manage your RDS environment, and much more? Let us know what you need, and we’ll send you a quote.

Remote Desktop Commander 4.5 Upgrade, Purchase, and Demo Links

If you are an existing Remote Desktop Commander SUITE subscription licensee and/or active maintenance agreement holder, click here to request upgrade instructions.

If you’d like to learn more about the Remote Desktop Commander Suite, including its feature set and how to start a subscription for only $9.99 per server per month, click here.

Request a web demo with an RDPSoft solutions expert to see all our solution’s features in depth.

RDPwned: A Guide To Securing Microsoft Remote Desktop Services

From the RDPSoft Blog

SPLA Reporting Made Easy

Reach Out