RDP Security Layer

Question

Hello. Can you explain all the options in this menu ? How does it work ? Recommendations ? If possible, more details with examples. You don't need to tell me about TLS, I know that.

Answer 1

Hello,

In Microsoft Remote Desktop Services (RDS), security is implemented through various layers and encryption levels to ensure the protection of data and secure remote connections.

1. Security Layer

This setting determines the security method used when clients connect to an RD Session Host server.

The three available security layers are:

• SSL (TLS 1.0) SSL (TLS 1.0) will be used for server authentication and for encrypting all data transferred between the server and the client.
• Negotiate The most secure layer that is supported by the client will be used. If supported, SSL (TLS 1.0) will be used. If the client does not support SSL (TLS 1.0), the RDP Security Layer will be used. This is the default setting.
• RDP Security Layer Communication between the server and the client will use native RDP encryption. If you select RDP Security Layer, you cannot use Network Level Authentication.

For more information, refer to: Secure RDS (Remote Desktop Services) Connections with SSL | Microsoft Learn

2. Encryption Level

This setting determines the extent to which data sent between the client and server is encrypted. 

Standard RDP Security supports four levels of encryption: Low, Client Compatible, High, and FIPS Compliant. The required Encryption Level is configured on the server.

• Low: All data sent from the client to the server is protected by encryption based on the maximum key strength supported by the client.
• Client Compatible: All data sent between the client and the server is protected by encryption based on the maximum key strength supported by the client.
• High: All data sent between the client and server is protected by encryption based on the server's maximum key strength.
• FIPS: All data sent between the client and server is protected using Federal Information Processing Standard 140-1 validated encryption methods.

Enhanced RDP Security supports a subset of the encryption levels used by Standard RDP Security. When a client connects to a server configured for Enhanced RDP Security, the selected encryption level returned to the client is ENCRYPTION_LEVEL_NONE (0). This is due to the fact that the encryption for the session is provided by an External Security Protocol and double-encryption of the RDP traffic (although possible) is not desirable from a performance standpoint.

Best regards

Jacen

———————————————————————————————————————

If the Answer is helpful, please click "Accept Answer" and upvote it.

Answer 2

I don't understand how SSL 1.0 can work when the latest Windows updates say that SSL 1.0\1.1 is insecure and outdated and is not supported in the latest updates. Maybe you forgot to update the RDS service ?