- #Windows server 2016 remote desktop best practice drivers
- #Windows server 2016 remote desktop best practice upgrade
- #Windows server 2016 remote desktop best practice full
- #Windows server 2016 remote desktop best practice software
- #Windows server 2016 remote desktop best practice windows
: Device guard enables administrators to define what software is trusted to run on the system. In addition, Remote Credential Guard is not supported when using an RDP gateway. This means that if the jump server is in a workgroup, or if there is no trust relationship between the user’s logon domain and the jump server ’s domain, the connection will use NTLM and Remote Credential Guard will not protect those credentials. Remote Credential Guard only works with Kerberos. Instead, Remote Credential Guard protects the user credentials by logging on using Kerberos single-sign-on tickets greatly reducing the risk of credential theft. With Remote Credential Guard, credentials aren’t actually sent to the jump server. Since jump servers are a central point for many different users to logon, the jump server exposes a high risk if an attacker is able to compromise it. : In the past, when users RDP to a server, the client would send their credentials (username/password) to the RDP server in order to log them on. If a user logs onto the jump server using a local account, those credentials will not be protected. For more details about this feature, seeĬredential guard protects only Kerberos and NTLM credentials. By enabling it on the jump server, it can protect users’ domain credentials which are otherwise unencrypted and susceptible to pass the hash attack. Kerberos tickets and NTLM hashes) in memory and stores the encryption key in an isolated space which is secured by the hypervisor. : Credential guard encrypts the domain credentials (i.e.
#Windows server 2016 remote desktop best practice windows
In the Microsoft internal deployment example, the jump server is designed to enable users to manage services using JEA, and is protected by the following features in Windows Server 2016: This characteristic makes jump servers a good candidate to lock down the software it trusts. Once deployed, the workload does not change very much.
#Windows server 2016 remote desktop best practice upgrade
However, there are some security features which do not require special hardware support, and you should enable these features on your existing hardware when you upgrade to Windows Server 2016:Ĭan be enabled on existing hardware without hardware support?Ī jump server typically runs on dedicated hardware within a physically secure perimeter, running a specific workload.
#Windows server 2016 remote desktop best practice full
In order to take advantage of the full set of security protections, the server hardware must support all of the above.
#Windows server 2016 remote desktop best practice drivers
Kernel mode drivers signed and compatible with hypervisor-enforced code integrity UEFI configured to prevent an unauthorized user from disabling Device Guard–dependent hardware security features (for example, Secure Boot) Virtualization extensions (for example, Intel VT-x, AMD RVI) Virtualization support enabled by default in the system firmware: UEFI Secure Boot (optionally with non-Microsoft UEFI CAs removed from the UEFI database ) If you are considering purchasing new hardware, check the
Windows Server 2016 (along with Windows 10) introduced a number of security features which require hardware support. In this blog post, I would like to focus on leveraging the security features in Windows Server 2016 to better protect against attacks on this server. There are additional protections by ensuring jump server access from a Privileged Access Workstation, you can find more details In addition, if a malicious actor takes over your jump server, they can act on behalf of connected users to take control over the assets that are managed through that jump server. When establishing the connections, user credentials are stored in memory, and these credentials are attractive targets for credential theft attacks. Jump servers enable users to connect and manage servers/services in separate security zones. Why is it important to secure a jump server?Ī jump server typically does not store any sensitive data you may wonder do I really need to secure it? Although it does not have sensitive data on disk, it does have sensitive data in memory. When talking to customers about the security features in Windows Server 2016, a common question keeps coming up, how do I secure my jump server? Recently, I worked with a Microsoft internal team to deploy Windows Server 2016 on their jump server I thought it is a good use case to share. First published on TECHNET on Feb 02, 2017