Limit the computers that can remote desktop to a server

Question

I have a Windows Server 2003 computer that is accessed by a remote desktop connection. To access the server all you need to know is the IP address of the computer.

I want to limit the computers that can access the Windows server computer to authorized computers only. The authorized computers won't have static IP addresses, so I cannot limit them on basis of IP address. Can I limit them on basis of MAC address perhaps? I won't mind using third-party solution like TeamViewer or LogMeIn, etc.

How can I solve this problem?

Solution 1

I found a possible solution in TeamViewer. TeamViewer creates a unique partner ID for the computer it is installed on. It has an option for allowing only authorized partner IDs to access the computer. Problem solved.

Solution 2

In nearly all cases you're going to end up with User+Group [and|or] certificate authentication instead of requesting-machine control. To clarify what cmbrnt mentioned re: LogMeIn, that is still a user-based authentication arrangement, and you're not specifying which client computers can make connection attempts.

You install the LogMeIn software at the host you want to control, and then you log in to the LogMeIn website (user authentication) to make a connection attempt to that host from wherever you want. After which, you'll authenticate again against that machine (or domain).

Therefore LogMeIn is more secure than simply punching a hole for RDP, as you have no exposed services and you're effectively authenticating twice, where both connections (client <-> LogMeIn <-> host) are over secured connections. There's even a third "host password" option you can use if you like, IIRC.

I believe LogMeIn ALSO has filtering for where the connection attempts come from, but they'd be by IP address, which as you stated, is not workable.

Comments

[Kez]

Changing your RDP port to something other than the usual 3389 will also help tighten security (unless you go with a third party piece of software). goo.gl/QdLdE

[DMA57361]

if the problem is solved, why don't you post that as an answer to your own question and then accept it; this way future visitors can find the results more easily and your question can be offically marked as complete.

[stirredo]

@DMA57361 - Done

[DMA57361]

Marvellous, thanks for keeping the site tidy. Have two +1's!