Still celebrating National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17

x
?
Solved

Securing a terminal server VM Environment

Posted on 2013-01-15
1
Medium Priority
?
334 Views
Last Modified: 2013-01-24
Hi,

We have a cloud environment where users log on to a terminal server through a TS Gateway
and TS Session broker that load balances users to various terminal services.  We want to secure this environment so that the users don't have a chance to compromise the security, such as disabling RDP to the Domain Controllers or Exchange servers on this virtual environment (right now admins have access as they are allowed to do some administration on their own cloud)  we're thinking to create a VPN for them to access the DC's and Exchanges and critical servers, and not be directly accessible from the terminal services, is that a viable policy? what else could we do to secure?  thanks!
0
Comment
Question by:sbsc
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
1 Comment
 
LVL 64

Accepted Solution

by:
btan earned 1500 total points
ID: 38782090
In general, to provide secure remote access, keep Terminal Servers in the private network, behind a firewall and access these machines via a reverse proxy or SSL VPN Device placed in a DMZ.

Good read on this as well. Critical server if possible should not be remotely managed unless necessary. If so there should be some form if second factor authentication using smartcard via the vpn client. The TS gateway can serves as gatekeeper but better to have ssl vpn gateway to front it and offload that. Such secure gateway will query ldap to identity store or perform radius check before graoting access...

http://www.petri.co.il/securing-rdp-remote-desktop-and-terminal-server-connections.htm
0

Featured Post

Looking for the Wi-Fi vendor that's right for you?

We know how difficult it can be to evaluate Wi-Fi vendors, so we created this helpful Wi-Fi Buyer's Guide to help you find the Wi-Fi vendor that's right for your business! Download the guide and get started on our checklist today!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Background Information Recently I have fixed file server permission issues for one of my client. The client has 1800 users and one Windows Server 2008 R2 domain joined file server with 12 TB of data, 250+ shared folders and the folder structure i…
For anyone that has accidentally used newSID with Server 2008 R2 (like I did) and hasn't been able to get the server running again because you were unlucky (as I was) and had no backups - I was able to get things working by doing a Registry Hive rec…
This tutorial will walk an individual through locating and launching the BEUtility application and how to execute it on the appropriate database. Log onto the server running the Backup Exec database. In a larger environment, this would generally be …
This tutorial will walk an individual through the steps necessary to configure their installation of BackupExec 2012 to use network shared disk space. Verify that the path to the shared storage is valid and that data can be written to that location:…

715 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question