What Account to use for RDP in to Servers

[maxrebo]

For the few years since I've been in current post we`ve been really lazy with logging into the server via RDP using a domain admin account, I know this is really bad practice...

 

What account level access do people use for this, and what s the best practices?

 

Thanks

[psydii]

into the main RDP server? a limited subset of standard staff accounts. Never a DA, and only a local administrator via the VM Session.

 

Into servers in general? each member of the IT team has a dedicated server admin account, and that is a Member of Protected Users. Each server has a domain/Universal group in AD called servername_admins and GPO/GPP makes that group the only member of the servers' local Administrators group.

Only members of a servers' local Administrators group can remote onto servers.

 

..except for a couple of servers where we also allow a small handful of users to remote on to poke a service they 'own' if the need to....

 

The servername_admins groups should always be empty unless an admin is actually working on a server. The dedicated server admins account also need to be members of what ever groups allow them access to the software repositories and documentation folders.

[mavhc]

The best best practise is to define all the tasks you need someone to do, set up groups that can do those permissions and add people's non workday admin accounts to that group, perform the task, and remove them, and log all those changes. Most things don't need to rdp to the server because you can remotely do them via MMC and Windows Admin Center and Powershell.

[jthompson]

Further to the responses above, I think it's also sensible to add the built-in domain Administrator account (i.e. DOMAIN\Administrator) and local built-in Adminstrator to the following Group Policy options:

• Windows Settings / Security Settings / Local Policies / User Rights Assignment / Deny access to this computer from the network
  
• Windows Settings / Security Settings / Local Policies / User Rights Assignment / Deny log on as a batch job
  
• Windows Settings / Security Settings / Local Policies / User Rights Assignment / Deny log on as a service
  
• Windows Settings / Security Settings / Local Policies / User Rights Assignment / Deny log on through Terminal Services
  

[dmj]

You shouldn't need to rdp into a server. I barely ever even shell into one.

[Davit2005]

Use a priveledged account not the normal user account. Account Delegation is the best option rather than using Domain Admin.

[dhicks]

What account level access do people use for this

 

Separate local admin account, with different credentials, for each server. Access for a user is via our web-based remote gateway behind a Cloudflare tunnel, authenticated with our 2FA-protected Google accounts. We don't have a Windows domain, so each of our Windows servers needs a local admin account anyway - we now only have a few local servers, the larger stuff (email, files) are now cloud based.