Hello everyone!
Today, a customer asked me to fix a problem that they consider a high security risk, and I cannot seem to find a solution for them.
They have a Windows 2012 (first release) RDS farm (but have already confirmed same problem exists with Windows 2012 R2 RDS farm). Security is important to them, so they have disallowed saving passwords for their RDS sessions. When a user connects, he is
asked for credentials. If they reconnect to a disconnected session, they also have to give their credentials. So far, so good.
However, recently users have discovered (you would think they have better things to do…), that you can reconnect to a connected session without credentials if reconnecting from the same client. The first RDP window will disconnect from the session as the
second window connects.
So now consider this scenario:
- A user has logged in to RDS (using his credentials)
- The user goes to lunch and locks his screen with Ctrl - Alt – End. He does this because IT department has repeatedly asked him to do this. His session is locked but not disconnected.
- As soon as he is gone, his colleague walks over to his desk, and minimizes his locked session using the connection bar or Ctrl - Alt - Break. The session is minimized, but
not disconnected.
- The user uses the same RDP file again to connect to RDS a second time. He is not asked for credentials.
- The first RDP window disconnects as a second RDP window comes up.
- The user finds the RDS sessionunlocked In the second RDP window, so he can use this method to unlock someone else's RDS session without credentials.
I have confirmed this problem exists with both type of clients they have: Windows 7 PC’s and Windows 10 PC’s.
The IT department has identified this as a major security problem in their company. I cannot find a way to force the Windows clients to ask for credentials in this situation. Also, I cannot find a way to prevent people from minimizing an RDS session.
Ctrl - Alt - Break always works.
Do you have any suggestions?