Certopolis

CompTIA A+ Core 2

Remote Desktop (RDP) setup and security for A+ Core 2

Remote Desktop listens on TCP port 3389 by default and must be enabled by an administrator on a Pro, Enterprise or Education host. Administrators can connect automatically; other accounts must be added as Remote Desktop users. For access from outside the network, Microsoft prefers a VPN over forwarding the port on the router.

Turning it on and who can connect

Enable it in Settings > System > Remote Desktop. Changing this setting needs membership of the Administrators group or administrative privileges.

When Remote Desktop is on, members of the Administrators group and any users you specify can connect. To let a standard user in without making them an administrator, add the account under Remote Desktop users (Select users that can remotely access this PC in older builds).

A connection works only when the remote PC is on and on the network, Remote Desktop is enabled, the client can reach it, the account is on the allowed list, and the remote PC's firewall allows Remote Desktop.

Port 3389 and changing it

Remote Desktop uses port 3389 by default. The port is stored in the registry value PortNumber under HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp.

After changing it, add an inbound Windows Firewall rule for the new port, and make sure any other firewall allows it. Clients then add the port to the address, for example pc1.contoso.com:3390. If the clients use the new port and still fail, the firewall rule is the usual gap.

Network Level Authentication and passwords

With Network Level Authentication (NLA), users must authenticate before a remote session is set up. Microsoft recommends keeping it on in most environments.

An older client that does not support NLA may need NLA turned off temporarily. Turn it back on as soon as possible.

Enabling Remote Desktop opens a port on the PC. Microsoft advises enabling it only on trusted networks and giving every account with remote access a strong, unique password.

Reaching a PC from outside its network

Remote Desktop is a direct connection to the host, so there are two options from outside: port forwarding on the router, or a VPN.

Port forwarding maps a port on the router's public IP address to the PC's internal address and port 3389. Microsoft warns this opens the PC to the internet and is not recommended. If it is used, restrict the source addresses on the router and use a strong password.

With a VPN, the client acts as if it is on the same network, and the PC is not exposed to the internet. Microsoft calls this preferable.

Where the exam catches people

  • Believing a standard user needs administrator rights to connect: adding the account under Remote Desktop users is enough.
  • Believing changing the RDP port only needs the registry edit: the new port also needs an inbound firewall rule.
  • Believing NLA should be turned off to make sign-in easier: Microsoft recommends keeping it on and disabling it only temporarily for clients that cannot use it.
  • Believing port forwarding 3389 is the recommended way in from home: Microsoft says it is not recommended and a VPN is preferable.
  • Believing a Home edition PC can accept Remote Desktop sessions: Home can only be a client.

Written from CompTIA's documentation

Try 3 questions on this

Pick an answer to see why each option is right or wrong.

  1. A technician changed the Remote Desktop listening port on a Windows workstation from 3389 to 3390. Remote users who add :3390 to the hostname still cannot connect. Which of the following should the technician do?

    Right. In the game that’s Renown for your Operational Procedures building.

    Not that one: D is right. In the game your Operational Procedures building would lose a little Renown, and this question would come back later.

    Show the full explanation and doc quotes

    The clients already address the new port, so the blocked port is the remaining fault.

    Written from learn.microsoft.com/en-us/windows-server/remote/remote-desktop-services/remotepc/change-listening-port

  2. A small office owner wants to work from home using Remote Desktop to reach a Windows 11 Pro desktop at the office. The office router has a public IP address. Which of the following is the best way for a technician to provide this access?

    Right. In the game that’s Renown for your Operational Procedures building.

    Not that one: A is right. In the game your Operational Procedures building would lose a little Renown, and this question would come back later.

    Show the full explanation and doc quotes

    Forwarding the port opens the PC to the internet, which Microsoft says is not recommended, and it states that a VPN is preferable; over the VPN the client acts as if it is on the same network.

    Written from learn.microsoft.com/en-us/windows-server/remote/remote-desktop-services/remotepc/remote-desktop-allow-outside-access

  3. Remote Desktop is enabled on a Windows 11 Pro workstation. A technician who is a local administrator connects to it from a user's laptop, but the user's standard account is refused. The user must not receive administrative rights. Which of the following should the technician do?

    Right. In the game that’s Renown for your Operational Procedures building.

    Not that one: C is right. In the game your Operational Procedures building would lose a little Renown, and this question would come back later.

    Show the full explanation and doc quotes

    A standard account must be added under Remote Desktop users (Select users that can remotely access this PC in older builds) before it can connect.

    Written from learn.microsoft.com/en-us/windows-server/remote/remote-desktop-services/remotepc/remote-desktop-allow-access