Remote desktop (RDP)
Also known as: RDP, remote desktop, Remote Desktop Protocol, remote access
Remote desktop (often RDP, Remote Desktop Protocol) lets you connect to and control another computer over a network, seeing its screen and using it as if you were there.
It's valuable for remote work and support, but exposing it directly to the internet is one of the most common ways attackers break into small businesses.
Remote desktop (RDP), explained at three levels
At home
Remote desktop is like a very long cable from your keyboard, mouse, and screen to a computer somewhere else. When you connect, the other computer sends you live pictures of its screen, and your typing and clicks are sent back to it. The programs and files never leave that computer; you are just operating it from a distance, such as using your office PC from your kitchen table.
At work
Remote desktop lets a person use another computer over a network as if sitting in front of it. On Windows, it usually runs on Microsoft's Remote Desktop Protocol, RDP. Businesses use it so staff can reach office PCs or shared servers from home. The catch is security: a remote desktop opened directly to the internet is one of the most common ways attackers break into small businesses.
At home
RDP has a host and a client. The host is the computer being controlled, which listens for connections on network port 3389 by default. The client is a Remote Desktop app on your laptop, tablet, or phone. After you sign in, the host sends compressed screen updates, and the client sends back keystrokes and mouse movements. It can also pass through printers, the clipboard, and drives, which is convenient but widens what an attacker could reach.
At work
In a workplace, RDP is used to reach individual office PCs or shared session hosts, where many users run apps on one server. The safe pattern is never to expose port 3389 to the internet. Instead, staff connect through a VPN, a Remote Desktop Gateway that wraps RDP in HTTPS and can enforce MFA, or a ZTNA service. Access is limited to named users, accounts lock after failed attempts, and hosts are kept patched.
At home
Attackers find exposed RDP by scanning the whole internet, which takes them minutes, then try leaked or common passwords thousands of times. Some flaws needed no password at all, such as BlueKeep in 2019, which could spread between computers on its own. Network Level Authentication helps by requiring sign-in before a full session starts. While a strong password helps, in my view any RDP port open to the internet will eventually be found and attacked.
At work
Hardened remote desktop puts a broker in front of every session: a Remote Desktop Gateway, Azure Virtual Desktop, or a ZTNA service, with MFA and conditional access. Hosts require Network Level Authentication, follow least privilege so users are not administrators, and send sign-in events to monitoring that alerts on brute-force attempts. Incident reports from insurers and responders repeatedly list exposed RDP among the top ransomware entry points, alongside VPN flaws and phishing.
Real-world examples
At home
Thomas wanted to reach his office PC from home and was about to enable remote desktop directly over the internet. His MSP stopped him, explaining that's exactly what ransomware gangs scan for, and instead set up access through a VPN with MFA, which is convenient and safe.
At work
A nearby business Marcus knew was hit by ransomware that entered through an exposed remote desktop. Learning from it, Marcus had his MSP confirm none of his machines had open RDP, routing all remote access through a secure gateway with MFA and login monitoring.
Common confusions
- Opening remote desktop to the internet is fine if I use a strong password — Attackers brute-force, exploit protocol flaws, and use stolen credentials. Exposed RDP is compromised constantly regardless of password strength. It should always sit behind a VPN or gateway with MFA.
- Remote desktop and VPN are the same thing — A VPN creates a secure tunnel to the network; remote desktop controls a specific computer. Often you use a VPN first, then remote desktop through it safely.
- If it's worked so far without incident, our RDP setup is safe — Exposed RDP may be probed for a long time before a successful breach. Absence of an incident isn't evidence of safety. It should be secured proactively.
For analysts
Never expose remote desktop directly to the internet. It's a leading ransomware entry point. Insist that all remote access runs through a VPN, gateway, or ZTNA with MFA, and ask your MSP to confirm no machine has an open RDP port.
History & origin
Microsoft's Remote Desktop Protocol has let users control Windows machines remotely for decades. As remote work grew, RDP became a convenient way to reach office computers from home. But attackers relentlessly scan the internet for exposed RDP and brute-force or exploit it. It became a leading entry point for ransomware, making secure configuration essential rather than optional.