Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I'm going to be out of the country for a while with my underpowered laptop, so, I wanted to get Remote Desktop Connection working (Windows 7).

I know I can forward ports and have it working, but what I'm wondering is:

  • Is Remote Desktop secure?
  • Is there any way I can turn my computer off AND ON over Remote Desktop?
  • Will I get hacked if I forward ports to Remote Desktop?
share|improve this question

1 Answer 1

up vote 3 down vote accepted

You can turn off the computer the command line way - with shutdown.exe, or hitting Ctrl + Alt + End, and then using the shutdown option there. Turning it back on will require something like Wake-on-LAN (WOL) and waiting for the system to boot up

RDP is fairly secure - 128-bit RC4 encryption by default, so there's less chance of someone listening in. On the other hand, to reduce the risk of brute force attacks you should probably use a strong password and a limited user account if possible. Also remember that Administrator is in the Remote Access group by default. You want to remove it from this group using local policy editor, otherwise its username/password is another brute force attack target and you want to reduce the target surface area as much as possible.

As for 'Will I be hacked?' - it depends on the hacker. For most part tho, RDP is reasonably safe, but that would depend on what vulnerabilities are out there.

share|improve this answer
    
Very good answer. Thank you very much. –  Dhaivat Pandya May 11 '11 at 22:51
    
To add to the (good) answer: Also consider renaming the Administrator account, and do try using usernames that are not too common. I'd also strongly recommend enabling account lockout policies. You "risk" being unable to logon remotely, but practically eliminate the risk of having your password brute forced. –  abstrask Jan 24 at 8:44
    
I just realise this is an old question, nonetheless I've pulled statistics over usernames for the last ~9.200 authentication failures, on a public facing RDP server. Some of the top (generic) usernames used for login attempts are: admin (1015), user (569), test (303), but also generic usernames like: support, system, root, manager, service –  abstrask Jan 24 at 8:57
    
That makes perfect sense really. Amusingly, the edit about the administrator group, and using a local policy editor was anonymous, and I was never able to thank the person who said this properly. –  Journeyman Geek Jan 24 at 23:57

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.