Hardening Security for RDP Logins to Windows ECSs

Basic ECS Details

Changing the Default Login Port

The default port for RDP logins is 3389. You can change it (for example, to 2020) to reduce exposure risks.

1. Use an RDP file to remotely log in to the ECS.
2. Press Win+R to open the Run dialog box. Enter regedit and press Enter to open Registry Editor.
3. In Registry Editor, choose HKEY_LOCAL_MACHINE > SYSTEM > CurrentControlSet > Control > Terminal Server > Wds > rdpwd > Tds > tcp and double-click PortNumber.
   1. In the displayed dialog box, set Base to Decimal.
   2. Change the value of Value data to the new port number, for example, 2020.
      Figure 1 Changing the port number to 2020
      
   3. Click OK.
4. In Registry Editor, choose HKEY_LOCAL_MACHINE > SYSTEM > CurrentControlSet > Control > Terminal Server > WinStations > RDP-Tcp and double-click PortNumber.
   1. In the displayed dialog box, set Base to Decimal.
   2. Change the value of Value data to the new port number, for example, 2020.
      Figure 2 Changing the port number to 2020
      
   3. Click OK.
5. Press Win+R to open the Run dialog box. Enter services.msc and press Enter to open the service panel.
   Figure 3 Service panel
   
6. Right-click Remote Desktop Services and choose Restart from the shortcut menu.
   Figure 4 Restarting services
   
7. Click Yes and wait until the service status changes to Running.
   Figure 5 Confirming the restart
   

Adding Firewall Rules to Open Specified Ports

1. Click the Windows icon in the lower left corner of the desktop and choose Control Panel > Windows Defender Firewall.
   Figure 6 Selecting Windows Defender Firewall
   
2. In the Windows Defender Firewall window, click Advanced settings in the navigation pane on the left.
   Figure 7 Clicking advanced settings
   
3. In the Windows Defender Firewall with Advanced Security window, click Inbound Rules in the navigation pane on the left.
   Figure 8 Inbound rules
   
4. Click New Rule in the Actions pane.

   Open a specific port as prompted. The following uses port 2020 as an example. To open port 2020, perform the following operations:

   1. In the Rule Type step of the New Inbound Rule Wizard dialog box, select Port and click Next.
      Figure 9 Rule type
      
   2. In the Protocol and Ports step, select TCP and Specific local ports, add a specific local port, and click Next.
      Figure 10 Protocols and ports
      
   3. In the Action step, select Allow the connection and click Next.
      Figure 11 Action
      
   4. In the Profile step, retain the default settings and click Next.
      Figure 12 Profile
      
   5. In the Name step, enter a rule name and click Finish.
      Figure 13 Name
      

   After the rules are added, the new port is opened, and the firewall of the ECS automatically allows the traffic on the opened port.

Adding a Security Group Rule

If the RDP login port of the ECS is changed to 2020, you need to add a rule to the security group.

1. Log in to the ECS console and access the ECS list page.
2. Click ECS ecs-796c to go to the ECS details page.
3. On the Security Groups tab, click Manage Rule on the right of the target security group.
   Figure 14 Managing rules
   
4. On the Inbound Rules tab, click Add Rule.
5. Add an inbound rule, as shown in Figure 15.
   Figure 15 Security group rules
   

Restricting RDP Login Users

By default, all users can log in to the ECS using RDP. You need to restrict the login only to users in the administrator group.

1. Press Win+R, enter lusrmgr.msc, and press Enter to open the local users and groups window.
   Figure 16 Local Users and Groups
   
2. In the left pane, select Groups, double-click Remote Desktop Users, and delete all non-administrator users.
3. Retain only the users in the Administrators group (which has been added by default) and click OK.

Configuring an IP Address Access Blacklist and Whitelist

You can use local security policies to allow only specified IP addresses to access RDP and block malicious IP addresses.

Creating an IP security policy

1. Press Win+R, enter secpol.msc, and press Enter to open the Local Security Policy window.
   Figure 17 Local Security Policy window
   
2. Right-click IP Security Policies on Local Computer and choose Create IP Security Policy from the shortcut menu.
   Figure 18 Creating an IP security policy
   
3. In the displayed IP Security Policy Wizard dialog box, click Next.
   Figure 19 IP security policy wizard
   
4. Enter a name, for example, RDP-IP-Allow, and click Next.
   Figure 20 Entering an IP security policy name
   
5. Click Next.
   Figure 21 Requests for secure communication
   
6. Click Finish.
   Figure 22 Computing the IP security policy wizard
   

Adding an IP security rule

1. Double-click the newly created RDP-IP-Allow and click Add.
   Figure 23 Properties
   
2. In the displayed Security Rule Wizard dialog box, click Next.
   Figure 24 Security rule wizard
   
3. In the Tunnel Endpoint step, select This rule does not specify a tunnel and click Next.
   Figure 25 Tunnel endpoint
   
4. In the Network Type step, select All network connections and click Next.
   Figure 26 Network type
   
5. In the IP Filter List step, click Add.
   Figure 27 IP filter
   
6. Enter a name, for example, Allow-Admin-IP, and click Add.
   Figure 28 Adding an IP filter
   
7. In the displayed IP Filter Wizard dialog box, click Next.
   Figure 29 IP filter wizard
   
8. Click Next.
   Figure 30 IP filter description and mirrored property
   
9. In the IP Traffic Source step, select A specific IP Address or Subnet for Source address, enter the administrator IP address for IP Address or Subnet, and click Next.
   Figure 31 Setting the source address
   
10. In the IP Traffic Destination step, select My IP Address for Destination address and click Next.
    Figure 32 Setting the destination address
    
11. In the IP Protocol Type step, select TCP for Select a protocol type and click Next.
    Figure 33 Selecting an IP protocol type
    
12. In the IP Protocol Port step, set the port to 2020 and click Next.
    Figure 34 IP protocol port
    
13. Click Finish.
    Figure 35 Completing the IP filter wizard
    
14. In the IP Filter List dialog box, click OK.
    Figure 36 IP filter list
    
15. Select the created IP filter and click Next.
    Figure 37 Selecting an IP filter
    
16. In the Filter Action step, click Add.
    Figure 38 Adding a filter action
    
17. In the displayed Filter Action Wizard dialog box, click Next.
    Figure 39 Filter action wizard
    
18. Enter a filter action name and click Next.
    Figure 40 Entering a filter action name
    
19. In the Filter Action General Options step, select Permit and click Next.
    Figure 41 Setting the filter action behavior
    
20. Click Finish.
    Figure 42 Completing the IP security filter action wizard
    
21. Select the added filter action and click Next.
    Figure 43 Selecting a filter action
    
22. Click Finish.
    Figure 44 Completing the security rule wizard
    

Deny all other IPs

Repeat steps 1 to 22 to create an IP filter, select Any IP address for Source address, Block for Filter Action General Options and ensure that only the specified IP address can access RDP.