Eliminate Internet-Exposed RDP Before It Eliminates You

If one item on this entire site deserves the Critical label, it is this one. Remote Desktop exposed directly to the internet is the most consistently exploited initial access vector in ransomware incident data, year after year. Exposed RDP endpoints are found by scanners within hours, added to brute-force target lists within days, and sold as access-broker inventory shortly after. Unlike most hardening work, this is not about reducing risk at the margins — an internet-facing RDP port on a domain-joined machine is a standing invitation, and closing it is measured in hours, not projects.

Why RDP exposure is uniquely dangerous

• It combines everything attackers want: password-only authentication by default, direct interactive access to a Windows session, a history of wormable vulnerabilities (BlueKeep and successors), and — on a domain-joined machine — a straight path to credential harvesting and lateral movement.
• The attack requires no phishing, no malware delivery, and no user interaction: a weak, reused, or previously breached password is the entire kill chain.
• Compromised RDP endpoints are commoditized: initial access brokers sell them in bulk, meaning the entity that breaches you and the ransomware operator that encrypts you are often different customers of the same listing.

Step 1 — Find every exposed instance today

• Scan your public IP ranges from outside for 3389/tcp — and do not stop there: check common "hidden" variants (custom high ports still fingerprint as RDP) since changing the port fools nobody's scanner.
• Check attacker-visible inventory services (Shodan, Censys) for your IP space and domains — if it is listed there, it has already been probed.
• Audit cloud environments separately: NSG/Security Group rules allowing 3389 from 0.0.0.0/0 are the cloud version of the same mistake, and Defender for Cloud / AWS tooling flags them natively.
• Do not forget the unofficial exposure: a well-meaning admin port-forwarding RDP on a branch firewall "temporarily" is how most instances are born. Firewall NAT rules are part of the audit.

Step 2 — Close it and migrate access

• Remove the firewall/NAT rules exposing RDP. This is the actual fix; everything below is how users keep working afterward.
• Route remote access through an authenticated layer: VPN with MFA as the baseline, or better, the ZTNA approach covered in the VPN-to-ZTNA item — per-application access with device posture checks.
• Where browser-based or brokered RDP is genuinely needed: RD Gateway with MFA (via NPS extension) on-premises, or Azure Bastion for Azure VMs — both terminate TLS properly and remove the raw 3389 listener from the internet.
• For vendor and third-party access, use time-limited, audited access paths (PAM/jump solutions), never a standing port-forward with a shared account.

Step 3 — Harden RDP internally too

• Require Network Level Authentication everywhere and enforce TLS for RDP connections via GPO.
• Restrict which accounts may RDP at all (Allow log on through Remote Desktop Services — a specific group, not Domain Users) and deny it for privileged Tier 0 accounts on lower-tier systems, consistent with the tiering model.
• Enable account lockout so internal brute force is loud and slow, and monitor Event IDs 4625 (failed logons, type 10) and 1149 (RDP connection) — a spike is one of the highest-signal alerts a SIEM can carry.
• Treat east-west RDP as privileged traffic: workstation-to-workstation RDP has almost no legitimate use and is a favorite lateral-movement channel — block it at the host firewall via GPO.

If you found an exposed instance during the audit

• Assume it was probed and possibly accessed: review authentication logs going back as far as retention allows, look for successful logons from unexpected geographies, new local accounts, and disabled security tooling.
• Rotate the passwords of every account that logged on to that machine, and treat any confirmed unauthorized logon as an incident — not a configuration finding.

The whole remediation typically fits inside a single change window: scan, close, redirect users, verify from outside. Few controls anywhere on this list buy this much risk reduction for this little effort — which is exactly why it is the site's first Critical item.