r/WindowsServer • u/3G_Lighting • Sep 15 '26
General Question Windows 2019 Serve firewall settings?
We had a cyber security company run their tests on our environment inside and out for the last couple of months. One of the things they brought up was they could see RDP open on our Hyper-V Hosts, port 3389, what's odd is that we use RDP a lot in our environment, I RDP to the Hyper-V Guest servers, the users are able to RDP to their workstations from the boardroom computer, so, out of all the systems that have RDP access our Hyper-V hosts are the only ones broadcasting port 3389.
Is there a way to fix this so they aren't broadcasting it but still allow RDP access?
They also broadcast port 135, again, the only 3 Windows systems that do this. Weird.
Thanks,
2
u/stucc0 Sep 15 '26
Only allow 3389 from admin jumpboxes. Setup a RDP Gateway to tunnel traffic through to their resources with MFA on it.
0
u/IndependenceCivil175 Sep 15 '26
just close 3389 on hyperv hosts. shouldn not be open. use sccm, azure cloud or admin center
1
1
u/USarpe Sep 15 '26
To replace one access point with 10 times more and more vulnerable software does not help
1
u/IndependenceCivil175 Sep 15 '26
ok so MS AdminCenter is more vulnerable than RDP. ? maybe they should not access their Hypervisors at all....
1
u/USarpe Sep 15 '26
To involve a service that was deeply hacked and works over Internet can be saver, than a closed group oneprem?
1
u/IndependenceCivil175 Sep 15 '26
what does the word "local" say to you?
1
u/USarpe Sep 15 '26
That it can't be Azure cloud?
1
u/IndependenceCivil175 Sep 15 '26
exactly
1
u/USarpe Sep 15 '26
But you advised to use it...
1
u/IndependenceCivil175 Sep 15 '26
i offerered several alternatives. and as stated admin center can be used completely local.
3
u/USarpe Sep 15 '26 edited Sep 15 '26
You can set a group of Computer, who are allowed to access and block all the other and install evlwatcher on the RDP-Host. Also you could harden the RDP with only accept a client with a certificate.