Remote Desktop is a fine way to reach an office computer. Opening it straight to the internet is not. Automated scanners find an open Remote Desktop port within hours and start guessing passwords around the clock, and exposed Remote Desktop is one of the most common ways ransomware gets into small businesses.
The fix is not to stop working remotely. It is to put something in front of Remote Desktop that checks who is connecting before Windows ever sees them.
Is yours exposed?
If someone once set up “port forwarding” on the office router so you could connect from home, it probably is. Remote Desktop listens on port 3389 by default. From a computer outside the office, an IT person can check the office’s public address with:
nmap -Pn -p 3389 <office public address>“Open” means anyone on the internet can reach the sign-in screen. Moving Remote Desktop to a different port does not fix this; scanners check every port.
Three safer ways in
A VPN
Staff connect to the office network first, then use Remote Desktop as if they were at their desks. Most business firewalls include a VPN, and WireGuard is a fast, simple option where they do not. Use one key or account per person, so one can be switched off without affecting the others.
A Remote Desktop gateway with multi-factor sign-in
A Windows server role that accepts connections over the normal secure web port and asks for a second sign-in step before passing them on. It suits offices that already run a Windows server.
A remote access service
Commercial remote support and access tools connect outward from the office computer, so nothing listens for incoming connections. Choose one that enforces multi-factor sign-in for every account and keeps a log of who connected and when.
Whatever you choose
- Close the port forward for 3389 on the router, then check again from outside.
- Require multi-factor sign-in for remote access.
- Use separate accounts for administration, and remove access the day someone leaves.
- Keep Windows and the firewall itself up to date. Firewalls and VPN boxes are targets too.
- Write down how remote access works, so the next person can switch someone off quickly.
Closing an exposed Remote Desktop port is often the single highest-value change I recommend after a check-up, and it usually takes an afternoon.