If I enabled Remote Desktop (RDP) on office computers, can someone connect from the internet?

opening rdp to the internet is weird, they just brute force it. changing the port doesn't help much. set up a vpn, then rdp. but setup is a bit hard...

Edit: asked below, I wrote the answer in the second message.

RDP bruteforce attacks basic tools: Hydra, Medusa, Masscan + RDP password list. An internet-exposed 3389 gets thousands of attempts per minute. Mitigation: 1) check nla_enforce and security layer: HKCU/Software/Policies/Microsoft/Windows NT/Terminal Services/SecurityLayer value 2 (default 0), 2) IP restriction: netsh advfirewall firewall add rule name='RDP restrict' dir=in action=block protocol=tcp localport=3389 /*, 3) VPN + RDP stacked deployment, 4) log monitoring with Siem.

Leaving RDP open is pretty risky. Best bet is to set up a VPN, takes an hour then force everyone to access the network via VPN... RDP should only be open through the VPN. But if setting up a VPN is hard for you: change the port, make the password strong and only allow access from your companys IP in the firewall. fail2ban is for Linux, not Windows so stick with VPN...

Remote access strategies: 1) VPN (OpenVPN, WireGuard): encrypted tunnel, IP masked, best for small teams, 2) Bastion Host (Jump Server): acts like a proxy, RDP only accessible from the bastion, 3) Zero Trust Access (Teleport, Gravitational): device verification, behavioral analytics, 4) RDP Gateway: Windows Server role, session logging. For SMEs, VPN is recommended — easy setup, low cost, high security.

If they gave out standard passwords via email, that's risky too. Do all employees have the same password? Or is each one different? If it's the same, once one is compromised, all computers are exposed. And did you check if NLA is enabled? On most systems it's disabled by default or weak...

If I understood correctly, youre saying: Taking measures without an inventory leaves doors you havent seen open.

Timely topic. An untested backup is not a backup.

Hope this helps.

Could you elaborate on that? Processes without records never improve because you don't know what to fix.

Any unwritten clause becomes a point of disagreement later as both sides remember it differently. Correct me if I'm wrong.

I can't fully agree with this. Solutions that work at a small scale collapse when you grow; I learned this late.

That's all, sorry if I went on too long.

I went through the same thing two years ago. If you don't write this down from the start it leads to arguments later.

Just leaving this note, it might be useful.

There's a common mistake people make when doing this. Mistakes made on the remote desktop security side are usually reversible but expensive.

The answer varies greatly by industry; there is no one-size-fits-all rule. This is my opinion, I'm not claiming it's absolute truth.

I've been dealing with this for a long time. The biggest time-waster for us was not knowing who had the final say.

Same here.

I feel the same way. When we decide without measuring, we always end up in the same place.

That's all, sorry if I went on too long.

I was thinking the same thing. Everything goes well for the first three months; problems arise in the fourth.

When making decisions, write down the worst-case scenario too, not just the best. I'm also curious if anyone does it differently.

Following. If you scold false alarms, nobody will report again.

Good luck with that.

I completely agree. People defend habits, not processes. Resistance comes from there.

Hope this helps.

I felt relieved reading this answer, so it's not just me. Most incidents start with a leaked password, not a vulnerability.