1

I have a Windows Server 2003 computer that is accessed by a remote desktop connection. To access the server all you need to know is the IP address of the computer.

I want to limit the computers that can access the Windows server computer to authorized computers only. The authorized computers won't have static IP addresses, so I cannot limit them on basis of IP address. Can I limit them on basis of MAC address perhaps? I won't mind using third-party solution like TeamViewer or LogMeIn, etc.

How can I solve this problem?

4
  • Changing your RDP port to something other than the usual 3389 will also help tighten security (unless you go with a third party piece of software). goo.gl/QdLdE
    – Kez
    Jan 15, 2011 at 9:48
  • 1
    if the problem is solved, why don't you post that as an answer to your own question and then accept it; this way future visitors can find the results more easily and your question can be offically marked as complete.
    – DMA57361
    Jan 17, 2011 at 9:14
  • @DMA57361 - Done
    – stirredo
    Jan 18, 2011 at 3:40
  • Marvellous, thanks for keeping the site tidy. Have two +1's!
    – DMA57361
    Jan 18, 2011 at 8:32

4 Answers 4

1

I found a possible solution in TeamViewer. TeamViewer creates a unique partner ID for the computer it is installed on. It has an option for allowing only authorized partner IDs to access the computer. Problem solved.

1

In nearly all cases you're going to end up with User+Group [and|or] certificate authentication instead of requesting-machine control. To clarify what cmbrnt mentioned re: LogMeIn, that is still a user-based authentication arrangement, and you're not specifying which client computers can make connection attempts.

You install the LogMeIn software at the host you want to control, and then you log in to the LogMeIn website (user authentication) to make a connection attempt to that host from wherever you want. After which, you'll authenticate again against that machine (or domain).

Therefore LogMeIn is more secure than simply punching a hole for RDP, as you have no exposed services and you're effectively authenticating twice, where both connections (client <-> LogMeIn <-> host) are over secured connections. There's even a third "host password" option you can use if you like, IIRC.

I believe LogMeIn ALSO has filtering for where the connection attempts come from, but they'd be by IP address, which as you stated, is not workable.

0
0

Logmein can do this for you, so you kind of answered your own question there. Basically, you install a client on your server and log in to logmein through that client, which limits the computers you can access it from, since you'll need your secure password. That requires you to trust logmein though, but I'm fairly sure you can do that.

I don't know of a way to do this using common RDP, except for configuring an advanced firewall which can set rules based on MAC-address. This will require the computer you're connecting from to sit on the same switch as the server though, since the source MAC-address is stripped from TCP/IP-packets when they traverse through a router.

0
0

Normally with RDP you do this on a per-user basis rather than per-machine basis. When you configure a server to allow remote desktop connections, by default only the Administrators group on that computer can access it. You have to specifically add any additional users or groups you want to allow.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .