prevent users using remote desktop

[+BudMan MVC]

Even if you blocked the exe from running, or blocked the port this will not actually stop anyone with half a brain ;)

Since they could just use vnc, or for that matter a java based remote desktop client, etc. Even if you block the ports, they could just use another one -- a required to be open port like 80 or 443, etc.

Once you have user that has some basic understanding of how this stuff works -- stopping them is like I stated before an uphill battle.

Sure you can block mstsc from running, that will stop them for about 2 minutes if your lucky ;) Maybe a day while change how they are accessing their remote machine ;)

Good Luck is about all I can tell you -- preventing someone with the correct skill set from creating a tunnel out of your network is near impossible.

[Adam1V]

ok, thanks for the info guys.

An uphill battle indeed, the only thing I have on my side is remote VNC with screen capture :D

[Si Veteran]

One option would be to really, really lock down their computers with a GPO so that nothing is available to them except what is needed to do their jobs. SteadyState does a great job with this, but I've not tried it in a domain environment (if it will even run inside one).

EDIT: The point here is to stop them bringing in some other client from the web or a removable drive etc, after you have blocked mstsc. Obviously if they are local admins you may have trouble still ;)

[+BudMan MVC]

And then you just boot a liveCD and remote to the machine that way.. So you have to lock down the machine from booting from removable media as well.

Your best bet when up against someone with the know how to tunnel is as already stated "policy" If you catch them at they get fired sort of thing.

What might slow them down some is if block the netblock their home isp is on. They would then have to have a different outside server to tunnel too, etc. Which could be a issue for some users to get around.

[Si Veteran]

  BudMan said:

Your best bet when up against someone with the know how to tunnel is as already stated "policy" If you catch them at they get fired sort of thing.

Completely agree.

  BudMan said:

What might slow them down some is if block the netblock their home isp is on. They would then have to have a different outside server to tunnel too, etc. Which could be a issue for some users to get around.

This is a damn fine idea!

[Adam1V]

  BudMan said:

What might slow them down some is if block the netblock their home isp is on. They would then have to have a different outside server to tunnel too, etc. Which could be a issue for some users to get around.

How would one go about this?

I know the ISP of the home user :)

or even better, I know the home fixed IP :)

[bobbba]

static route on their client for their home ip to divert to nowhere maybe?

or look at what your router/firewall/proxy can do.

[+BudMan MVC]

I would suggest you block his ISPs whole netblock, since he could just get a different IP from tomorrow, etc.. Doing it at the client is a bad idea -- since a boot of some liveCD removes anything you might have done there.. But sure if they are not as bright as we are making them out to be -- then just put a simple static route on his client to point that address or range to nevernever land.

But best to do it at the gateway. You said your using SBS2003, but only have the standard (no ISA) using just ICS I assume? Then you could just put the static route on that server. Now nobody is getting there ;)

[Adam1V]

  BudMan said:

But best to do it at the gateway. You said your using SBS2003, but only have the standard (no ISA) using just ICS I assume? Then you could just put the static route on that server. Now nobody is getting there ;)

I think its all done in routing and remote access?

Lets say the destination machine is 123.456.789.0

I create a static route:

Destination: 123.456.789.0

Network Mask: 255.255.255.255 (this correct?)

Gateway: <server IP> (if i want to redirect him back to sharepoint hompage??)

Thanks in advance..

[bobbba]

you can't direct it to a replacement ip, the idea is that you give it a broken route that goes nowhere. plus this is to prevent remote desktop not IE so what's the point!

don't forget to make your static route persistent as well!