Limit the computers that can remote desktop to a server

Question

I have a windows server 2003 computer that is accessed by remote desktop connection. To access the server all you need to know is the IP address of the computer.

I want to limit the computers that can access the windows server computer to authorized computers only. The authorized computers won't have static IPs, so I cannot limit them on basis of IP address. Can I limit them on basis of MAC id perhaps? I won't mind using third party solution like Teamviewer or Logmein etc.

So how can I solve this problem?

Answer 1

Found a possible solution in team viewer. Team viewer creates a unique partner ID for the computer it is installed on. It has an option for allowing only authorized partner IDs to access the computer. Problem solved.

Answer 2

Logmein can do this for you, so you kind of answered your own question there. Basically, you install a client on your server and log in to logmein through that client, which limits the computers you can access it from, since you'll need your secure password. That requires you to trust logmein though, but I'm fairly sure you can do that.

I don't know of a way to do this using common RDP, except for configuring an advanced firewall which can set rules based on MAC-address. This will require the computer you're connecting from to sit on the same switch as the server though, since the source MAC-address is stripped from TCP/IP-packets when they traverse through a router.

Answer 3

In nearly all cases you're going to end up with User+Group [and|or] Certificate authentication instead of requesting-machine control. To clarify what cmbrnt mentioned re: logmein, that is still a user based authentication arrangement, you're not specifying which client computers can make connection attempts. You install the logmein software at the host you want to control, then you log in to the logmein website (user auth) to make a connection attempt to that host from wherever you want. After which, you'll authenticate again against that machine (or domain).

Therefore Logmein IS more secure than simply punching a hole for RDP, as you have no exposed services and you're effectively authenticating twice, where both connections (client<>logmein<>host) are over secured connections. There's even a third "host password" option you can use if you like, iirc.

EDIT: Additional clarification... I believe Logmein ALSO has filtering for where the connection attempts come from, but they'd be by IP address, which as you stated, is not workable.

Answer 4

Normally with RDP you do this on a per-user basis rather than per-machine basis. When you configure a server to allow remote desktop connections, by default only the Administrators group on that computer can access it. You have to specifically add any additional users or groups you want to allow.