Jet Mariano

Securing Remote Work: How to Protect Your Computer When Using VPN and RDP

Written by

jetnmariano

in

With the rise of remote work and hybrid environments, many IT professionals access their work machines using VPN and RDP (Remote Desktop Protocol). While this setup provides flexibility, it also presents security risks—especially when working in a cross-domain network or dealing with multiple IT teams.

As an IT professional with experience in Citrix VDI for banking and enterprise security, I’ve implemented best practices to ensure my remote work setup is secure against unauthorized access. Here’s how you can do the same.

🔍 Understanding the Security Risks of VPN + RDP

A typical work-from-home setup involves:
✅ Connecting to a corporate VPN (e.g., Cisco AnyConnect, Fortinet, or Palo Alto GlobalProtect)
✅ Using RDP (Remote Desktop Protocol) to access your work machine

However, if not properly secured, this configuration could expose your computer to:
⚠ Unwanted access from other IT personnel within the VPN network
⚠ Brute-force RDP attacks if port 3389 is open
⚠ Drive redirection vulnerabilities, where attackers can view or copy your files
⚠ Misconfigured VPN routes, allowing unauthorized users to connect to your machine

To prevent these risks, I follow a strict security protocol when using VPN and RDP.

🛡️ Step-by-Step Guide: How to Secure Your Work Computer When Using VPN + RDP

1️⃣ Enforce Network Level Authentication (NLA) for RDP

Network Level Authentication (NLA) ensures that only authenticated users can initiate RDP sessions, blocking unauthorized login attempts.

✅ How to enable NLA:

  1. Open System Properties (sysdm.cpl)
  2. Go to the Remote tab
  3. ✅ Check “Allow connections only from computers running Remote Desktop with Network Level Authentication”
  4. Click Apply > OK

🔹 Why it matters? Without NLA, an attacker can initiate an RDP connection and attempt brute-force attacks before authentication.

2️⃣ Restrict RDP Access to VPN-Only IP Ranges

By default, Windows allows RDP connections from any network. To prevent unauthorized access, restrict RDP connections only to your VPN subnet.

✅ How to block all external RDP access except your VPN subnet:

  1. Open Windows Defender Firewall
  2. Navigate to Advanced Settings > Inbound Rules
  3. Find Remote Desktop – User Mode (TCP-In)
  4. Right-click > Properties > Scope
  5. Under Remote IP Address, choose These IP addresses
  6. Add only your VPN subnet (e.g., 172.16.104.0/24)
  7. Click Apply > OK

🔹 Why it matters? Even if someone inside your network tries to RDP into your machine, their connection will be blocked unless they are in the allowed VPN range.

3️⃣ Disable Drive Redirection in RDP

RDP allows drive redirection by default, which means that if an attacker gains access, they can browse and copy files from your local machine.

✅ How to disable RDP drive redirection:

  1. Open Group Policy Editor (gpedit.msc)
  2. Navigate to: pgsqlCopy codeComputer Configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Device and Resource Redirection
  3. Find “Do not allow drive redirection”
  4. Set it to Enabled
  5. Click Apply > OK

🔹 Why it matters? This prevents your local drives from being exposed during RDP sessions.

4️⃣ Monitor RDP Access Logs for Unauthorized Connections

Since you’re the only one RDPing into your machine, it’s important to monitor login attempts to detect any suspicious activity.

✅ How to check RDP login logs in Event Viewer:

  1. Open Event Viewer (eventvwr.msc)
  2. Navigate to: nginxCopy codeWindows Logs > Security
  3. Look for:
    • Event ID 4624 (successful logins)
    • Event ID 4625 (failed logins)

🔹 Why it matters? If you see failed logins from unknown IPs, someone may be trying to brute-force your RDP connection.

5️⃣ Disable Remote Access for Unauthorized Users

IT admins in your network may have elevated privileges, allowing them to remotely manage your system. To block unauthorized admin access, you can disable remote administration tools.

✅ How to remove unauthorized administrators:

  1. Open PowerShell as Administrator
  2. Run the following command to list local administrators: powershellCopy codenet localgroup Administrators
  3. If you see any unauthorized users, remove them: powershellCopy codenet localgroup Administrators "DOMAIN\Username" /delete

🔹 Why it matters? Even with VPN access, they won’t be able to take control of your system.

💡 Alternative: Using Citrix VDI Instead of RDP for Secure Access

Since I’ve worked with Citrix Virtual Desktop Infrastructure (VDI) for banks, I know that virtual desktops eliminate most RDP risks. Instead of exposing RDP ports, a Citrix setup allows users to access their workstations securely via a web portal.

✅ Why Citrix VDI is better than RDP over VPN:
🚀 No direct RDP connection – Reduces attack surface
🚀 User sessions are isolated – Prevents unauthorized access
🚀 Secured with multi-factor authentication (MFA) – Extra security

If your organization supports it, using Citrix or Windows Remote Desktop Web Access (RD Web) is a safer alternative.

🔎 Final Thoughts

Working remotely via VPN + RDP is convenient, but it must be properly secured to prevent unauthorized access and IT snooping. By implementing:
✅ Network Level Authentication (NLA)
✅ Restricting RDP to VPN-only IP ranges
✅ Disabling drive redirection
✅ Monitoring login logs
✅ Removing unauthorized admin users

You can ensure that your remote work environment remains private and secure.

🔹 If you’re managing an enterprise network, consider moving to Citrix VDI or Windows RD Web for an extra layer of security.

💡 Have questions about securing your remote access? Drop a comment below!

More posts

error: Content is protected !!