5.5 Secure RDP Access, Remote Desktop Gateway & Azure Bastion

Secure RDP Access, Remote Desktop Gateway & Azure Bastion

Interactive graphical management remains an essential requirement for Windows Server administration, specialized application maintenance, and emergency troubleshooting. However, exposing the standard Remote Desktop Protocol (RDP) directly across untrusted networks or the public internet represents one of the most severe attack vectors in enterprise IT, frequently leading to credential brute-forcing, ransomware deployment, and remote code execution exploits.

Securing hybrid enterprise access demands a layered defense-in-depth architecture incorporating Network Level Authentication (NLA), perimeter Remote Desktop Gateway (RD Gateway) servers, fully managed Azure Bastion PaaS proxies, and automated Just-in-Time (JIT) VM Access orchestrated by Microsoft Defender for Cloud.

---

1. RDP Security Baseline & Network Level Authentication (NLA)

Standard RDP operates over TCP port 3389 (with optional UDP 3389 for RemoteFX streaming optimizations). In legacy implementations, a server accepted the TCP connection and initialized the full graphical subsystem (Winlogon desktop) before prompting the connecting client for credentials, exposing the server to severe memory exhaustion and pre-authentication exploits.

+-----------------------------------------------------------------------------------------+
|                        NETWORK LEVEL AUTHENTICATION (NLA) WORKFLOW                      |
|                                                                                         |
|  [RDP Client]                                              [Target Windows Server]      |
|        |                                                                 |              |
|        | 1. Initiates CredSSP Handshake (TCP 3389)                       |              |
|        |---------------------------------------------------------------->|              |
|        |                                                                 |              |
|        | 2. Client authenticates via Kerberos / TLS (Pre-Auth)           |              |
|        |<===============================================================>|              |
|        |                                                                 |              |
|        | [Authentication Evaluated BEFORE Spawning RDP Session / RAM]    |              |
|        |                                                                 |              |
|        | 3. Successful Auth -> Spawns Winlogon / Desktop Session         |              |
|        |<----------------------------------------------------------------|              |
|        |    (If Auth Fails: Connection Terminated with ZERO OS Overhead) |              |
+-----------------------------------------------------------------------------------------+

Network Level Authentication (NLA) Mechanics:

• CredSSP Pre-Authentication: NLA utilizes the Credential Security Support Provider (CredSSP) protocol to authenticate user credentials before the server establishes a full Remote Desktop session or renders the Windows logon screen.
• Resource Protection: Because unauthenticated requests are rejected during the initial cryptographic handshake, the host server consumes negligible CPU and RAM, mitigating RDP Denial-of-Service (DoS) and automated port-scanning attacks.
• Enforcing NLA via Group Policy:
  • Path: Computer Configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Security
  • Setting: Require user authentication for remote connections by using Network Level Authentication -> Enabled.

# Enforce Network Level Authentication via PowerShell Registry Modification
Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' `
    -Name "UserAuthentication" -Value 1 -Force

# Enable Remote Desktop in Windows Defender Firewall
Enable-NetFirewallRule -DisplayGroup "Remote Desktop"

---

2. Remote Desktop Gateway (RD Gateway) Architecture

For on-premises data centers and private cloud environments, Remote Desktop Gateway (RD Gateway) provides secure perimeter RDP encapsulation, allowing external remote administrators to connect securely to internal network servers without establishing a full virtual private network (VPN) tunnel.

+-----------------------------------------------------------------------------------------+
|                         RD GATEWAY PERIMETER TUNNELING TOPOLOGY                         |
|                                                                                         |
|  [External Remote Admin]                                                                |
|  - Runs: mstsc.exe                                                                      |
|        |                                                                                |
|        | HTTPS Tunnel: TCP 443 (Control) & UDP 3391 (Data)                              |
|        | Encrypted with Public CA SSL/TLS Certificate                                   |
|        v                                                                                |
|  +-----------------------------------------------------------------------------------+  |
|  |                     PERIMETER DMZ: RD GATEWAY SERVER                              |  |
|  |                                                                                   |  |
|  |  +-----------------------------------------------------------------------------+  |  |
|  |  | [1. RD Connection Authorization Policy (RD CAP)]                            |  |  |
|  |  | - WHO can connect? (e.g., CORP\RemoteAdmins Group)                           |  |  |
|  |  | - Auth Method: Password + Smart Card / RADIUS MFA (NPS Extension)           |  |  |
|  |  +-----------------------------------------------------------------------------+  |  |
|  |                                      |                                            |  |
|  |                                      v Passes CAP Validation                      |  |
|  |  +-----------------------------------------------------------------------------+  |  |
|  |  | [2. RD Resource Authorization Policy (RD RAP)]                              |  |  |
|  |  | - WHAT computers can be targeted? (e.g., CORP\Tier1-Servers Computer Group)  |  |  |
|  |  | - Allowed Ports: Port 3389 Only                                             |  |  |
|  |  +-----------------------------------------------------------------------------+  |  |
|  +-----------------------------------------------------------------------------------+  |
|                                         |                                               |
|                                         | Standard Internal RDP (TCP 3389)              |
|                                         v                                               |
|                         [Internal Datacenter Servers (Private LAN)]                     |
+-----------------------------------------------------------------------------------------+

RD CAP vs. RD RAP Policies

[!IMPORTANT] The CAP + RAP Two-Key Rule: To establish an RDP session through an RD Gateway, a connecting client must satisfy BOTH an RD CAP and an RD RAP. If the user passes the RD CAP (valid identity and MFA) but requests a server not authorized in any matching RD RAP, the gateway immediately terminates the connection.

---

3. Azure Bastion: Architecture, Sizing & SKU Tiers

Azure Bastion is a fully managed Platform-as-a-Service (PaaS) service deployed directly inside an Azure Virtual Network (VNet). It delivers secure, seamless RDP and SSH connectivity to Azure virtual machines directly through the Azure Portal via an HTML5 browser session or via native client tooling over TLS port 443.

Azure Bastion SKU Capability Matrix

Subnet & Network Security Group (NSG) Rules for Azure Bastion:

• Subnet Naming: The dedicated subnet MUST be named exactly AzureBastionSubnet.
• Subnet Sizing: Microsoft recommends a subnet prefix of /26 or larger (/25, /24) to accommodate host autoscaling (each host unit provisions internal proxy VMs).
• Mandatory Inbound NSG Rules on AzureBastionSubnet:
  • Port 443 Inbound from Internet (Target: *, Protocol: TCP)
  • Port 443 Inbound from GatewayManager service tag
  • Port 443 / 4443 Inbound from VirtualNetwork service tag (Internal data plane)
• Mandatory Outbound NSG Rules on AzureBastionSubnet:
  • Port 3389 / 22 Outbound to VirtualNetwork (Target VMs)
  • Port 443 Outbound to AzureCloud service tag

Native Client Connectivity via Azure CLI:

With Azure Bastion Standard or Premium SKU, administrators can bypass the web browser and launch native local client applications (mstsc.exe for RDP or native SSH) tunneled securely through Bastion over port 443:

# Log in to Azure and tunnel native RDP session through Azure Bastion
az login
az network bastion rdp \
    --name "vnet-hub-bastion" \
    --resource-group "rg-networking-prod" \
    --target-resource-id "/subscriptions/.../resourceGroups/rg-compute/providers/Microsoft.Compute/virtualMachines/AZ-DC01"

---

4. Just-in-Time (JIT) VM Access with Microsoft Defender for Cloud

Just-in-Time (JIT) VM Access is a cloud security feature provided by Microsoft Defender for Cloud (Defender for Servers Plan 2) that eliminates persistent management port exposure on Azure IaaS virtual machines.

+-----------------------------------------------------------------------------------------+
|                        JUST-IN-TIME (JIT) ACCESS LIFECYCLE                              |
|                                                                                         |
|  [BASELINE: All Management Ports LOCKED]                                                |
|  - NSG Rule Priority 4096: DenyAllInbound (Ports 3389, 22, 5985, 5986 Closed)          |
|                                      |                                                  |
|                                      v                                                  |
|  [STEP 1: REQUEST] Admin requests JIT access via Azure Portal / Azure CLI / PowerShell   |
|  - Target VM: AZ-APP01 | Port: 3389 | Duration: 3 Hours | Source IP: My IP (Caller)     |
|                                      |                                                  |
|                                      v Evaluates Azure RBAC Permissions                 |
|  [STEP 2: NSG ELEVATION] Microsoft Defender for Cloud Injects High-Priority NSG Rule   |
|  - Rule Priority 100: AllowInbound RDP 3389 from Caller Public IP ONLY                 |
|                                      |                                                  |
|                                      v Administrator connects via RDP                   |
|  [STEP 3: AUTO-EXPIRATION] Time Window Closes (3 Hours Elapsed)                         |
|  - Defender for Cloud automatically purges Priority 100 NSG rule                       |
|  - Inbound port 3389 returns to blocked state                                          |
+-----------------------------------------------------------------------------------------+

Core Mechanics of JIT VM Access:

1. Management Port Lockdown: When JIT is activated on a virtual machine, Defender for Cloud inspects the VM's Network Security Group (NSG) and creates an explicit Deny rule for inbound management ports (TCP 3389 for RDP, TCP 22 for SSH, TCP 5985/5986 for WinRM).
2. On-Demand Rule Injection: When an authorized user requests access, Defender for Cloud evaluates their Azure RBAC permissions (requiring Microsoft.Security/locations/jitNetworkAccessPolicies/initiate/action). Upon approval, Defender for Cloud dynamically provisions an Allow NSG rule with a high priority (e.g., Priority 100) that permits traffic:
   • Only to the requested port.
   • Only from the requester's specific source IP address (or specified CIDR range).
   • Only for the approved duration (default 3 hours, configurable between 1 and 24 hours).
3. Automatic Revocation: Once the approved duration expires, Defender for Cloud automatically deletes the temporary Allow NSG rule, returning the VM to a locked state without requiring manual intervention.

Requesting JIT Access via Azure PowerShell:

# Request on-demand RDP JIT access for 3 hours restricted to the current caller public IP
$JITParams = @{
    ResourceGroupName = 'rg-compute-prod'
    Location          = 'eastus'
    VMName            = 'AZ-SQL-01'
    Port              = '3389'
    Duration          = 'PT3H'
    AllowedSourceAddressPrefix = '198.51.100.25/32'
}

Start-AzJitNetworkAccessPolicy -ResourceId "/subscriptions/.../providers/Microsoft.Security/locations/eastus/jitNetworkAccessPolicies/default" `
    -VirtualMachine $JITParams

---

5. Hybrid Remote Access Architectural Decision Matrix

Selecting the appropriate remote management technology depends on network topology, security compliance mandates, and operational tooling requirements.