“We just opened Remote Desktop so the accountant could work from home during the lockdown.” Years later, the port is still open. Automated scanners find it within days and try passwords around the clock. One weak or reused password later, an attacker is on the server, and ransomware follows. It’s one of the most common ways into small business networks, and one of the easiest to close.
Close Remote Desktop to the internet
- Never expose Remote Desktop (port 3389) directly to the internet.
- Use a VPN with MFA, or Remote Desktop Gateway, instead.
- Check your firewall for old port-forwarding rules nobody remembers.
- Turn on account lockout and alerts for failed sign-ins.
The rest of the Windows Server hardening list
- Windows LAPS: a unique, rotating local admin password on every server, built into current Windows Server versions.
- Minimal roles: install only the roles and features the server needs.
- Separate admin accounts: admins don’t browse the web or read email with their admin account.
- Updates: install monthly updates and reboot on a schedule.
- Logging: keep security logs long enough to investigate an incident.
A 30-minute check you can do this week
- Ask your IT team or provider for a list of every port forwarded through your firewall, and what each one is for.
- Remove anything nobody can explain.
- Confirm remote access goes through a VPN or gateway with MFA.
- Check that every server has a unique local admin password.
How Pentacle IT Solutions can help
Pentacle IT Solutions, a Microsoft Solutions Partner for Infrastructure (Azure), hardens and supports Windows Server for businesses in Lucknow and across Uttar Pradesh. As a Sophos Gold Partner, we also set up Sophos Firewall secure remote access with VPN and MFA, so Remote Desktop never has to face the internet.
