Remote Desktop Open to the Internet: The Risk
7 min read
Besides email attachments, the other common way ransomware reaches a small company is Remote Desktop. Somebody wanted to reach the office machine from home, so a supplier was asked to "open it up", or a few boxes were ticked on the router. From that moment the login screen on that computer is visible to the entire world. This covers only that one entrance: why it is dangerous, how it differs from connecting through a VPN first, and what can be done today without changing anything structural.
1. It may already be open without anyone knowing
Remote Desktop is rarely exposed deliberately. It happens because a need pushed it there. Somebody had to work from home, a supplier said maintenance would be easier this way, or the bookkeeper occasionally needs to pull a report. Whoever set it up meant well, and at the time it genuinely solved the problem.
The trouble is that the setting has no expiry date. The need passes and the configuration remains. Three years later that computer is running an operating system that stopped getting updates, the password is still the original one, and it spends twenty-four hours a day accepting login attempts from around the world. Nobody gets an alert, because accepting logins is what it is supposed to do.
There are two ways to check. Look at the router or firewall for a rule forwarding inbound connections to a particular machine; Remote Desktop uses port 3389 by default. The more intuitive test is to ask whether anyone can sit outside the office, connect to nothing first, and open Remote Desktop straight onto an office computer. If the answer is yes, it is open.
2. What actually happens once it is exposed
Nobody singles you out. The whole thing is automated. Programs sweep the internet range by range looking for addresses that answer on 3389, and once they find one they start trying usernames and passwords. One machine works many targets at once and is in no hurry. Your size, your profile and your industry make no difference at this stage.
The guesses are not random either. Default names go first: administrator, admin, user. Then come credential lists from various leaks. If your administrator account is called admin and the password is the company name plus a year, it will not hold for long.
What follows a successful guess is the worse part. What the attacker gets is not a web admin panel, it is a whole computer, usually with administrator rights. They can see the shared folders, install things, and reach further into the office network from that machine. That is why this route shows up so often in ransomware cases.
3. How connecting through a VPN first differs
People often assume a VPN is just an extra hop, but the difference is fundamental. A VPN first builds an encrypted tunnel between your computer and the office network, and once you are on it your machine behaves as though it were sitting in the office. Remote Desktop then runs inside that tunnel, with no entrance exposed to the outside at all.
Microsoft's own documentation on reaching your PC from outside the network puts it bluntly: forwarding the port means opening your PC up to the internet, which is not recommended, and the same page suggests a VPN instead. That is not a security consultant's opinion, it is the vendor's own position.
| Exposed directly | VPN first, then Remote Desktop | |
|---|---|---|
| What the outside world sees | A login screen anybody can reach | Only the VPN entrance; Remote Desktop is not exposed |
| Who can attempt a login | Everybody | Only holders of a VPN account or certificate |
| Cost of a guessed password | A complete computer, straight away | There is still Remote Desktop to get past |
| Records | Scattered on that machine, where nobody looks | The VPN end shows who connected and when |
| Setup effort | Minutes | Equipment or a service, accounts to issue, people to train |
To be straight about it, a VPN is not a cure-all. VPN appliances have their own vulnerabilities and need patching like anything else, and if the whole company shares one VPN account you have moved the same problem one step along. Its real value is turning "anybody in the world can knock" into "only key holders can knock", and collapsing the number of internet-facing things you have to maintain from one per computer down to one.
4. What you can do today without rebuilding anything
If a VPN is not realistic right now, everything below can be done inside the setup you already have, and the risk drops noticeably once it is. The order reflects what each one buys you.
Doable before you leave today
- Confirm whether it still needs to be open at all. This one pays back the most. Ask who is still using it, and plenty of companies find the need disappeared two years ago. If nobody uses it, close it. That costs nothing.
- Restrict the source. Most routers and firewalls let you allow inbound connections only from specific external addresses. If only the owner's home connection ever uses it, allow that one and block everything else. Second only to closing it entirely.
- Rename the default administrator account and disable unused accounts. Default names are the first thing automated attempts try, so renaming makes that entire wave miss.
- Set an account lockout threshold. Microsoft's documentation says it plainly: limiting failed sign-ins nearly eliminates brute force attacks, and the security baselines suggest 10 as a starting point. Know the side effect too. Somebody attempting logins maliciously can lock accounts out, so learn how to unlock them first.
- Bring that machine's updates up to date. A machine facing the internet has no room to defer patching. This is not a one-off; put it in a fixed slot.
- Open the sign-in logs once. The failed login records in Event Viewer will tell you how many attempts a day you are getting. That number tends to land hard, and it is the most effective single exhibit for getting a budget approved.
5. If you do rebuild, what the options cost
Where the need for remote access is real, it deserves an approach built for it rather than a whole computer left hanging outside. Three options come up in practice for small companies, at very different costs and skill levels.
The first is running a VPN at the office. Most business-grade routers and firewalls include the capability, so this is the cheapest route. The downsides are that the appliance itself has to be kept patched, and accounts have to be one per person. Sharing one account undoes the whole exercise.
The second is a cloud remote access service. The provider maintains the connection channel, your computers open no inbound entrance at all, and setup is straightforward. The cost is a monthly fee, and the fact that you have handed a route into your office to a third party. Look at the provider's own security history and whether it supports two-factor authentication.
The third is a Remote Desktop gateway, which suits companies already running Windows server infrastructure. Every connection arrives through one controlled entrance, policy is applied uniformly, and the records are in one place. It takes more skill to set up than the other two and generally needs somebody to maintain it.
6. It has been open a while. How to tell whether anything happened
Start with the logs. Windows Event Viewer records both successful and failed sign-ins. The point is not that there are thousands of failures, which is normal. The point is whether there are successes, and whether the timing of those makes sense. A successful login at three in the morning when nobody was working is where you start digging.
Then look for accounts that appeared from nowhere, scheduled tasks nobody created, or antivirus that has been switched off. Those are the most common traces left after a successful login. How to work through a compromised office computer systematically is a separate subject and not one this piece opens up.
If somebody did get in, the first move is not a reinstall. Disconnect that machine from the internet, preserve its current state, and establish which shared folders and which other machines it could reach. Rushing to reinstall washes away the evidence of how far this went, and that evidence is the only thing that later answers what the attacker touched.
There is nothing wrong with Remote Desktop. What is wrong is hanging its login screen directly on the internet. That is not a question of the odds of being noticed, it is automated attempts arriving every single day. Find out whether it is open right now, and close it if nobody is using it. If it is genuinely needed, pull the entrance behind a VPN or a controlled access service and put a second factor on it. If that is out of reach for the moment, at least set the source restriction, the account rename and the lockout threshold before the end of today.
Common questions
- If Remote Desktop is exposed, will it really get found?
- Yes, usually within hours. The process is automated: programs sweep the internet for addresses that answer, and start trying credentials as soon as one does. Company size, profile and industry make no difference at that stage. If you want proof, open the failed sign-in records in Event Viewer on that machine and count a day's worth. Most people stop asking the question after seeing the number.
- If I change the Remote Desktop port, is it safe?
- Not safe, but still worth doing. Automated programs that only look at the default port will skip you and the failed login records get much quieter, which helps you notice real anomalies. Anyone scanning you specifically still finds it, so it cannot replace restricting the source, renaming the default administrator account and setting a lockout threshold. Treat it as noise reduction rather than protection.
- Do I have to use a VPN rather than exposing Remote Desktop?
- Microsoft's own documentation recommends a VPN, on the grounds that exposing the port opens the whole computer to the internet. The difference is what the outside can see: exposed, anybody can reach that login screen, whereas behind a VPN only one entrance faces outward and an account is needed to get through it. A VPN is not a cure-all though. The appliance needs patching, and accounts have to be one per person, because sharing one defeats the purpose.