0

Ok, Why ?

There is some users on the local network that are accessing an remote desktop servers

But some of these user also required an way to connect to the remote desktop but from internet. That alternate port is forwarded to the internet

The way I added the second listening port is this way http://jvhconsulting.wordpress.com/2010/11/16/adding-or-changing-remote-desktop-listening-port/

Is there a way to let Only certain user access the alternate port using the original windows "Remote Desktop Connection"

Perhaps there is a way to select witch user have the right to connect to port 3389 and witch user can connect to port 3399 Perhaps something like local serurity policy have a setting some where.

Thanks for any help :)

Improve this question
9
  • ok, I'm not sure what you mean by port, but Transport layer ports (TCP/UDP) cannot be restricted to "users" only to packet characteristics occurring at the transport layer or lower. if you want to filter access by criteria on a higher level, you will have to leave authentication and authorization up to the application itself, in this case RDP.
    – Frank Thomas
    Jul 25, 2014 at 18:32
  • Yes, this is what i mean. Is there a way rdp can let only certain users to connect to it alternate port that it listening.
    – Nicolas Racine
    Jul 25, 2014 at 18:34
  • no, because ports don't know what user is trying to connect, and RDP doesn't care what port you're coming in on. You could probably setup IP restrictions for the port in your firewall(s), so only certain IPs are able to access the port, but that means any user from that IP can get in, and if an allowed user moves someplace else (or their IP changes), they won't be allowed in.
    – Ƭᴇcʜιᴇ007
    Jul 25, 2014 at 18:49
  • 2
    unfortunately, you probably can't run two instances of the RDP service, with separate configuration. and you can't firewall based on user. the best bet would be to allow your approved remote users to VPN into your network, and control it there, but that involves some infrastructure. perhaps you can implement some form of Port Knocking: en.wikipedia.org/wiki/Port_knocking
    – Frank Thomas
    Jul 25, 2014 at 18:49
  • @FrankThomas I am currently thinking of an other way, That might work actualy.. I am currently playing around with localgroup polcy editor and saw that when a user is loggin in. we can lauch script. That made me think.. What do you guys think of lauching a script in the script to check if user is an user that is alowed and if not kick log him off Whould that be secure enough ?
    – Nicolas Racine
    Jul 25, 2014 at 18:52

1 Answer 1

Reset to default
2

A better approach to this (and the method Microsoft recommends you do) is not expose a RDP port to the outside at all. Instead expose a VPN port that the user can connect to, then once on the VPN connection they can connect to the RDP server.

This will allow you to restrict which users have VPN access separate from which users have RDP access.

If you don't want to set up a VPN the other option is to use a Remote Desktop Gateway Manager that sits on the border between the public internet and your internal machines. You can set up rules for the RD Gateway limiting which users can connect and what machines the users are connecting to.

Improve this answer
3
  • Yea, But I can't change the way people connect right now,. But there is in place a system that send an email to us and create a firewall rule if too much fail login occur
    – Nicolas Racine
    Jul 25, 2014 at 19:51
  • Hum!,. Il have to read on that,. ( Remote Desktop Gateway Manger ) Look promising. And could maybe be acceptable change for users to login,. The only thing is that some user have to connect localy so i hope that gateway dont need to be connected stricly from internet.
    – Nicolas Racine
    Jul 25, 2014 at 19:55
  • The Gateway approach, if set up fully, will work without people needing to do any extra steps. The box for "Automatically Detect RD Gateway settings" is on by default in the remote desktop client. (Show more options -> Advanced -> Settings)
    – Scott Chamberlain
    Jul 25, 2014 at 19:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .