Within our legacy infrastructure we need to keep port 3389 exposed so that we can remote desktop into this server (note that we can't go back and utilize IaC to prevent this).

We currently restrict the IP range that can access this port. Is this enough for security? This article mentions never globally exposing this port: https://www.grc.com/port_3389.htm

1 Answer 1


You can add, if it's not already the case, a frontal, rev proxy, to prevent direct access to the TS. This could also add an authentication layer... I am not a lot in Microsoft stuff so this is really a basic advice. If TS allow the use of pubkey instead of passwd this would be a good addition too.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.