windows server 2012 remote desktop security

The remote computer must be running at least patched Windows 7 or patched Windows Server 2008 R2. The remote computer can run any Windows operating systemīoth the client and the remote computer must be running at least Windows 10, version 1607, or Windows Server 2016. User logs on to the server as local administrator, so an attacker cannot act on behalf of the 'domain user'. An attacker can act on behalf of the user only when the session is ongoing Use the following table to compare different Remote Desktop connection security options:Ĭredentials on the server are not protected from Pass-the-Hash attacks. The following diagram helps you to understand how Windows Defender Remote Credential Guard works, what it helps to protect against, and compares it with the Restricted Admin mode option:Īs illustrated, Windows Defender Remote Credential Guard blocks NTLM (allowing only Kerberos), prevents Pass-the-Hash (PtH) attacks, and also prevents use of credentials after disconnection. The following diagram helps you to understand how a standard Remote Desktop session to a server without Windows Defender Remote Credential Guard works: For information on Remote Desktop connection scenarios involving helpdesk support, see Remote Desktop connections and helpdesk support scenarios in this article.Ĭomparing Windows Defender Remote Credential Guard with other Remote Desktop connection options

Windows server 2012 remote desktop security