Limit RDP connections for certain user groups to IP


Recommended Posts

I have a win 2003 standard edition server running as a web server, with Remote Desktop to admin it. I also have a static IP address at this end.

I know I can IPSec ALL Remote Desktop connections to a set IP address, but can I somehow limit administrator groups to my static IP address, but allow a standard user to connect from any IP address?

Thanks in advance.

huh?

You can control who has access to remote desktop by group or user account. The builtin administrators group has permissions by default, but you can add other groups or users that you want to be able to remote desktop.

As to IPSec all remote desktop connections?? :blink:

You can modify your IP security policies with secpol.msc, you can create IP filters there as well -- is this what your asking?

Edited by BudMan
  tiddlie said:
No - I want to limit the access to remote desktop via remote IP address. I want only my static IP to be allowed to login via a user in the administrator group, but a 'standard' user to have access from any IP address.
This makes NO sense.. So your allowing users from any IP access.. Then all IPs have access.

Sorry but that tool controls access to the PORT 3389, it does not say oh your from IP address X you can login as a USER, but not as an Admin User.

Oh your from IP Y, you can login as Admin.

"Logon screen is only displayed if the connection is established from particular IPs or machines. Computers that do not meet the filter restrictions don't see the logon screen & won't get to try a brute force logon!"

Since your allowing any IP to use remote desktop.. Then any IP will get the login screen -- an if they have a valid user account that can remote desktop, then they can log in.

Here are the filters you can use from that tool;

--

This is the main SecureRDP page. It includes several filters that can be combined to create very complex conditions that must be met in order to be able to logon to your Terminal Server. These filters include:

IP Address: restricts the connection by checking the client IP Address.

Computer Name: restricts the connection by checking the client computer name.

MAC address: restricts the connection by checking the client PC MAC address. Note that this filter works only for computers on the same subnet as your Terminal Server.

Client Version: restricts the connection by checking the Terminal Services Client version. To make this filter more effective you should be using a customized Terminal Services Client with your own version number. This service is available in our website at http://www.terminal-services.NET.

Time Restriction: restricts the connection by checking the logon date and time.

--

What he is asking does not even make any sense to do anyway.. Users that are NOT admin should really not even have remote desktop access to a server. But since your going to allow them access -- yes if they knew the admin password, they would be able to login as an admin. Even if you blocked their remote desktop login - they could just login as a user, then run whatever they wanted as the admin account.

Edited by BudMan

Agreed -- an than can be done with a simple IP security filter using secpol, or your firewall, etc.

No need for the tool -- its pretty much just a gui that puts some settings all in the same place for people that do not now how to use their own OS ;)

Well, I have no direct access to the server. Obviously, leaving RDP open to all IP addresses is a real problem - goes without saying. Hence why I want to limit the admin access to my static IP address.

I do however, work away from time to time, and only have access to the internet via a laptop on a public or hotel lan. Should I need to access the server whilst away to do a simple task such as edit the php.ini file, or reboot IIS, it would be handy to have a somewhat locked down account that allows me these limited functions. Obviously, this needs to be accessed from a public IP addess.

If this is a roundabout way to do it - hey - we all learn, and advice is always appreciated.

And surely Windows 2003 fits into your description of that tool Budman....a 'gui that puts some settings all in the same place' - 2003 seems to be entierly made up of wizards.....

They have had wizards since the first version of windows -- does not mean you have to use them ;)

An I agree -- I would never open up RDP to the public NET.

You should access it thru a VPN or SSH/SSL tunnel, etc. This allows you to move around, just setup TLS auth to the server -- just keep your cert with you. Be it auth to the VPN/SSL or Remote Desktop or private key access to the SSH server.

This prevents bruteforce attacks, an allows you access from anywhere on the planet.

http://technet2.microsoft.com/windowsserve...3.mspx?mfr=true

Configuring authentication and encryption

http://support.microsoft.com/kb/895433

How to configure a Windows Server 2003 terminal server to use TLS for server authentication

For example -- you can only access my home network with OPENVPN or SSH, I keep my keys on my thumbdrive -- so I can access all of my machines from anywhere on the planet either with just putty an tunnel anything I need or with the openvpn client -- an again all services are open to me just as if I was on the local lan -- just a bit slower ;)

Putting up any type of service that only requires a password to access is just asking for trouble!

edit: BTW the IP an or fqdn to access my server along with the cert/key passwords are in my head -- so even if I loose the thumb drive -- the finder does not have access to anything.

Edited by BudMan
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • Oh for crying out loud, more AI rubbish. It gets everywhere, well almost. i use Numbers on the Mac, which does what I need, at the moment I can turn any AI off, but maybe i should go back to LibreOffice.
    • Google Sheets gets exciting Gemini feature that is still missing in Excel by Usama Jawad We recently learned that Copilot in Microsoft Excel got a big upgrade in the form of context awareness, which is in addition to the formula generation capabilities that were made available earlier. However, no firm has really won the AI race yet, and Google has now edged ahead in at least one domain today, by adding Gemini text generation capabilities in Google Sheets. In a blog post, Google has announced that while you can already leverage Gemini in Sheets to generate charts and insights, you can now generate text using its new AI function too. This function can utilize a natural language prompt and an optional context window to summarize and generate text, categorize information, and perform sentiment analysis. The syntax for the AI function is fairly straightforward: AI("prompt",[optional range]) So you can invoke the Gemini function as follows: =AI("Perform sentiment analysis on the emails sent by the customers to the barbershop.", C2) Or: =AI("Create an email to the reviewer addressing specific items in their reviews.", A2:G2) It is very interesting to note that a similar capability is not offered by Copilot in Excel yet. In my testing, I did get Copilot to generate charts, formulas, and do some text formatting, it simply doesn't seem to have the ability to actually generate textual data directly in a workbook just yet. While an input range isn't mandatory, Google recommends using it for the best results. Just like any cell using a formula, you can refresh the AI cell, and get an indicator about its sync state. That said, a limitation that is present with regards to the AI function is that it only works for the first 200 selected cells in your range. Once that generation completes, you can select more cells and repeat the process, which is a slightly cumbersome experience. The rollout for this capability has begun across Business, Enterprise, Education, Education Premium, AI Pro, and Ultra plans, so it should be available to everyone sooner rather than later. In the meantime, you can view details about the AI function here.
    • Space Marine 2 gains a horde mode and DLSS 4 with new Siege update by Pulasthi Ariyasinghe Warhammer 40,000: Space Marine 2 just received its next major update. Dubbed the Siege update, it is finally bringing the long-promised horde mode for the third-person action game, as well as new tech for PC gamers. The Siege mode takes place on a fortified Imperial stronghold on Kadaku that is enduring endless attacks by Tyranids and Thousand Sons. There are three sections in total that players will defend in order before circling back to the original position, fighting away thousands of enemies in five waves before swapping locations. To give players a small break, there's a one-minute gap between each wave to resupply and purchase perks from the points they collect while in battle. Players can call in AI-controlled specialized soldiers, Space Marines, or even a Dreadnought to help out if the waves get a little too tough. To cap it all off, every fifth wave a boss encounter kicks off. There are 15 waves to go through in a single session, but parties can also kick off an endless mode at the end of these to see how far they can get. "Siege Mode expands on our PVE operations, emphasizing endless enemy waves that challenge even the strongest teams," says Focus Entertainment, describing the new mode. "When overwhelmed, players may call reinforcements for assistance. Engage in intense battles across three distinctive sectors, each requiring strategic adaptation. Side objectives emerge during combat, providing essential resources used to summon elite Space Marines or a formidable Dreadnought, drastically shifting battlefield dynamics. Over on PC, the studio has added two new options. One is RTAO (Ray-Traced Ambient Occlusion), though this is currently listed as an experimental feature. Next, Nvidia 5000 series graphics card owners can now enable DLSS 4 for better upscaling tech as well as multi-frame generation. The complete patch notes for Patch 8, which includes details on the balance changes, can be found here. The Warhammer 40,000: Space Marine 2 Siege update is now available on PC, Xbox Series X|S, and PlayStation 5.
    • Microsoft updates Media Creation Tool with a newer Windows 11 release by Taras Buria If you want to download a Windows 11 image or create an install media, the Media Creation Tool app is one of the best options—simple, fast, and, more importantly, official. While there are other useful alternatives, such as Rufus, Media Creation Tool remains the default choice for those who simply want a clean Windows 11 installation on a supported computer. Thanks to the latest MCT update, you will have to deal with fewer updates after installing Windows 11. Microsoft has quietly updated the Media Creation Tool app so that it downloads the latest Windows 11 release, version 24H2, with build number 26100.4349. This is the most recent public Windows 11 update (June 2025 Patch Tuesday), which eliminates the need to download large updates for your PC after installing the operating system. You can download Media Creation Tool from the official Windows 11 website. If you are familiar with it, this simple app can generate a Windows 11 image with the language you need or create a bootable USB media. Note that it only works on Windows, so Linux or macOS users have to download Windows images directly from the official website and then use apps that are available on their platforms. Another thing worth noting is Media Creation Tool is not the right choice if you want to install Windows 11 on an unsupported PC. In such a case, you can use MCT to download an ISO and then create a modified install media with apps like Rufus or Ventoy as described in our dedicated guide. If you want a more exotic Windows 11 Edition, try the Oofhours Media Tool, which allows you to select Windows 10 or 11, architecture (x64, x86, or ARM64), language, and edition. In addition to standard Home and Pro, the application can download non-mainstream SKUs, such as Enterprise, Education, or Professional for Workstations. Via: Deskmodder
  • Recent Achievements

    • Conversation Starter
      Kavin25 earned a badge
      Conversation Starter
    • One Month Later
      Leonard grant earned a badge
      One Month Later
    • Week One Done
      pcdoctorsnet earned a badge
      Week One Done
    • Rising Star
      Phillip0web went up a rank
      Rising Star
    • One Month Later
      Epaminombas earned a badge
      One Month Later
  • Popular Contributors

    1. 1
      +primortal
      539
    2. 2
      ATLien_0
      207
    3. 3
      +FloatingFatMan
      175
    4. 4
      Michael Scrip
      148
    5. 5
      snowy owl
      118
  • Tell a friend

    Love Neowin? Tell a friend!