Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have a Windows Server 2003 computer that is accessed by a remote desktop connection. To access the server all you need to know is the IP address of the computer.

I want to limit the computers that can access the Windows server computer to authorized computers only. The authorized computers won't have static IP addresses, so I cannot limit them on basis of IP address. Can I limit them on basis of MAC address perhaps? I won't mind using third-party solution like TeamViewer or LogMeIn, etc.

How can I solve this problem?

share|improve this question
    
Changing your RDP port to something other than the usual 3389 will also help tighten security (unless you go with a third party piece of software). goo.gl/QdLdE –  Kez Jan 15 '11 at 9:48
1  
if the problem is solved, why don't you post that as an answer to your own question and then accept it; this way future visitors can find the results more easily and your question can be offically marked as complete. –  DMA57361 Jan 17 '11 at 9:14
    
@DMA57361 - Done –  stirredo Jan 18 '11 at 3:40
    
Marvellous, thanks for keeping the site tidy. Have two +1's! –  DMA57361 Jan 18 '11 at 8:32

4 Answers 4

up vote 1 down vote accepted

I found a possible solution in TeamViewer. TeamViewer creates a unique partner ID for the computer it is installed on. It has an option for allowing only authorized partner IDs to access the computer. Problem solved.

share|improve this answer

In nearly all cases you're going to end up with User+Group [and|or] certificate authentication instead of requesting-machine control. To clarify what cmbrnt mentioned re: LogMeIn, that is still a user-based authentication arrangement, and you're not specifying which client computers can make connection attempts.

You install the LogMeIn software at the host you want to control, and then you log in to the LogMeIn website (user authentication) to make a connection attempt to that host from wherever you want. After which, you'll authenticate again against that machine (or domain).

Therefore LogMeIn is more secure than simply punching a hole for RDP, as you have no exposed services and you're effectively authenticating twice, where both connections (client <-> LogMeIn <-> host) are over secured connections. There's even a third "host password" option you can use if you like, IIRC.

I believe LogMeIn ALSO has filtering for where the connection attempts come from, but they'd be by IP address, which as you stated, is not workable.

share|improve this answer
    
Thanks for answering. –  stirredo Jan 17 '11 at 9:03

Logmein can do this for you, so you kind of answered your own question there. Basically, you install a client on your server and log in to logmein through that client, which limits the computers you can access it from, since you'll need your secure password. That requires you to trust logmein though, but I'm fairly sure you can do that.

I don't know of a way to do this using common RDP, except for configuring an advanced firewall which can set rules based on MAC-address. This will require the computer you're connecting from to sit on the same switch as the server though, since the source MAC-address is stripped from TCP/IP-packets when they traverse through a router.

share|improve this answer
    
Thanks for answering. –  stirredo Jan 17 '11 at 9:02

Normally with RDP you do this on a per-user basis rather than per-machine basis. When you configure a server to allow remote desktop connections, by default only the Administrators group on that computer can access it. You have to specifically add any additional users or groups you want to allow.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.