Share via

Regarding Security issue on svchost.exe -k termsvcs -s TermService

Anonymous
2023-10-17T02:21:45+00:00

We recently added the EDR platform SentinelOne in our infrastructure and we noticed all of our Windows Server got below logs regarding to C:\Windows\System32\svchost.exe -k termsvcs -s TermService to connect to 3389 port, which raised a security issue to the management, We would like to know that what is the purpose of Source Process Command Line "C:\Windows\System32\svchost.exe -k termsvcs -s TermService" used for.

And is it normal behavior that it will access the 3389 port on the network?

On the other hand, we can confirm normal RDP session will be logged as MSTSC.

We tried to analyze the 3389 port connection logs but no details can be found...

Windows for business | Windows Server | Networking | Network connectivity and file sharing

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question. To protect privacy, user profiles for migrated questions are anonymized.

0 comments
Accepted answer
  1. Anonymous
    2023-10-17T07:08:41+00:00

    Hello Kevin

    This line of text describes how a Windows system is using the svchost.exe program to run TermService, which allows remote desktop connections on port 3389. Port 3389 is the default port used by Remote Desktop Services. This is a common configuration for enabling remote access to a Windows computer, often used for tasks like remote administration or support.

    If you suspect it in any way, it could be a security concern, as unauthorized access to port 3389 could lead to security risks.

    It is recommended to ensure that the RDS are properly secured by implementing strong passwords, enabling Network Level Authentication (NLA), and restricting access to RDS to only authorized users. Additionally, you may want to consult with your EDR platform provider to see if they have any recommendations for monitoring and securing Remote Desktop Services.

    Regards,

    Karlie

    1 person found this answer helpful.
    0 comments

0 additional answers

Sort by: Most helpful
Most helpful Newest Oldest