PowerShell: Windows Server – Harden RDP Without Breaking Access

.\Set-HardenedRdpConfiguration.ps1 -AllowedSource "10.10.5.0/24"

.\Set-HardenedRdpConfiguration.ps1 -AllowedSource "10.10.5.0/24", "10.10.6.10" -IdleTimeoutMinutes 15 -DisconnectedSessionTimeoutMinutes 30 -DisableDriveRedirection -DisableClipboardRedirection -AllowRestrictedAdmin

WARNING: Rule 'Allow 3389 - legacy' (enabled, inbound, TCP 3389) is not in the Remote Desktop group and still allows RemoteAddress Any. Review it; this script does not change it.

UserAuthentication SecurityLayer MinEncryptionLevel DisableRestrictedAdmin
------------------ ------------- ------------------ ----------------------
                 1             2                  3                      0

MaxIdleTime MaxDisconnectionTime fDisableCdm fDisableClip
----------- -------------------- ----------- ------------
     900000              1800000           1            1

RuleName                                  RemoteAddress
--------                                  -------------
Remote Desktop - User Mode (TCP-In)       {10.10.5.0/255.255.255.0, 10.10.6.10}
Remote Desktop - User Mode (UDP-In)       {10.10.5.0/255.255.255.0, 10.10.6.10}

mstsc.exe /v:<server> /restrictedAdmin
mstsc.exe /v:<server> /remoteGuard

<#
.SYNOPSIS
    Hardens Windows Server RDP: NLA, TLS, session limits, redirection, and a source-IP allowlist.
.DESCRIPTION
    On the RDP-Tcp listener, requires Network Level Authentication
    (UserAuthentication = 1), the TLS security layer (SecurityLayer = 2) and High
    encryption (MinEncryptionLevel = 3). Writes idle and disconnected session
    limits and optional drive and clipboard redirection blocks to the Terminal
    Services policy key. Optionally allows Restricted Admin mode and Remote
    Credential Guard, and disables TLS 1.0/1.1 server protocols. Scopes the
    enabled inbound rules in the Remote Desktop firewall group to the allowlist,
    warns about other rules that open TCP 3389, and warns when Group Policy
    already controls a listener setting.
.PARAMETER AllowedSource
    IP addresses or CIDR ranges allowed to reach RDP. Must include the range you
    are connecting from, or you will lock yourself out.
.PARAMETER IdleTimeoutMinutes
    Idle time before an active session is disconnected. Default 30.
.PARAMETER DisconnectedSessionTimeoutMinutes
    How long a disconnected session is kept before it is ended. Default 60.
.PARAMETER DisableDriveRedirection
    Blocks client drive mapping (and clipboard file copy) into sessions.
.PARAMETER DisableClipboardRedirection
    Blocks clipboard sharing between the client and the session.
.PARAMETER AllowRestrictedAdmin
    Sets DisableRestrictedAdmin = 0 so clients can use Restricted Admin mode or
    Remote Credential Guard.
.PARAMETER DisableLegacyTls
    Disables the TLS 1.0 and TLS 1.1 server protocols in Schannel. Restart required.
.EXAMPLE
    .\Set-HardenedRdpConfiguration.ps1 -AllowedSource "10.10.5.0/24" -IdleTimeoutMinutes 15 -DisableDriveRedirection
.NOTES
    Author  : Thomas Lasswell (https://www.techcolumnist.com)
    Version : 1.0 (2025-09-17)
    Requires: Windows Server 2016 or later, NetSecurity module, Administrator
#>
[CmdletBinding()]
param (
    [Parameter(Mandatory = $true)]
    [string[]]$AllowedSource,

    [ValidateRange(1, 1440)]
    [int]$IdleTimeoutMinutes = 30,

    [ValidateRange(1, 1440)]
    [int]$DisconnectedSessionTimeoutMinutes = 60,

    [switch]$DisableDriveRedirection,

    [switch]$DisableClipboardRedirection,

    [switch]$AllowRestrictedAdmin,

    [switch]$DisableLegacyTls
)

$listenerPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp"
$policyPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services"
$lsaPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa"

if (-not (Test-Path -Path $listenerPath)) {
    throw "RDP-Tcp listener key not found. Is Remote Desktop configured on this host?"
}

# Warn when Group Policy already sets a listener value; the GPO wins over the local registry.
$general = Get-CimInstance -Namespace "root\cimv2\TerminalServices" -ClassName Win32_TSGeneralSetting -Filter "TerminalName='RDP-Tcp'" -ErrorAction SilentlyContinue

if ($general) {
    foreach ($source in @("PolicySourceUserAuthenticationRequired", "PolicySourceSecurityLayer", "PolicySourceMinEncryptionLevel")) {
        if ($general.$source -eq 1) {
            Write-Warning "$source = Group Policy. The local value set below will be overridden; change the GPO instead."
        }
    }
}

# Listener: NLA required, TLS security layer, High encryption.
Set-ItemProperty -Path $listenerPath -Name "UserAuthentication" -Value 1 -Type DWord
Set-ItemProperty -Path $listenerPath -Name "SecurityLayer" -Value 2 -Type DWord
Set-ItemProperty -Path $listenerPath -Name "MinEncryptionLevel" -Value 3 -Type DWord

# Session limits and redirection through the policy key. Values are milliseconds.
if (-not (Test-Path -Path $policyPath)) {
    New-Item -Path $policyPath -Force | Out-Null
}

New-ItemProperty -Path $policyPath -Name "MaxIdleTime" -Value ($IdleTimeoutMinutes * 60000) -PropertyType DWord -Force | Out-Null
New-ItemProperty -Path $policyPath -Name "MaxDisconnectionTime" -Value ($DisconnectedSessionTimeoutMinutes * 60000) -PropertyType DWord -Force | Out-Null

if ($DisableDriveRedirection) {
    New-ItemProperty -Path $policyPath -Name "fDisableCdm" -Value 1 -PropertyType DWord -Force | Out-Null
}

if ($DisableClipboardRedirection) {
    New-ItemProperty -Path $policyPath -Name "fDisableClip" -Value 1 -PropertyType DWord -Force | Out-Null
}

# Restricted Admin mode and Remote Credential Guard need delegation of non-exportable credentials.
if ($AllowRestrictedAdmin) {
    New-ItemProperty -Path $lsaPath -Name "DisableRestrictedAdmin" -Value 0 -PropertyType DWord -Force | Out-Null
}

# Legacy TLS off for every Schannel server on the box. Takes effect after a restart.
if ($DisableLegacyTls) {
    foreach ($protocol in @("TLS 1.0", "TLS 1.1")) {
        $serverKey = "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\$protocol\Server"

        if (-not (Test-Path -Path $serverKey)) {
            New-Item -Path $serverKey -Force | Out-Null
        }

        New-ItemProperty -Path $serverKey -Name "Enabled" -Value 0 -PropertyType DWord -Force | Out-Null
    }

    Write-Warning "TLS 1.0/1.1 server protocols disabled. Restart the server for Schannel to pick this up."
}

# Firewall: scope the enabled inbound Remote Desktop rules to the allowlist.
$rdpRules = @(Get-NetFirewallRule -DisplayGroup "Remote Desktop" -ErrorAction SilentlyContinue |
    Where-Object { $_.Direction -eq "Inbound" -and $_.Enabled -eq "True" })

if ($rdpRules.Count -eq 0) {
    Write-Warning "No enabled inbound Remote Desktop firewall rules found. Firewall scope was not changed."
}

foreach ($rule in $rdpRules) {
    Set-NetFirewallRule -Name $rule.Name -RemoteAddress $AllowedSource
}

# Any other enabled allow rule on TCP 3389 would bypass the allowlist.
$rdpRuleNames = $rdpRules | ForEach-Object { $_.Name }
$otherRules = Get-NetFirewallPortFilter -Protocol TCP |
    Where-Object { $_.LocalPort -contains "3389" } |
    Get-NetFirewallRule |
    Where-Object { $_.Enabled -eq "True" -and $_.Direction -eq "Inbound" -and $_.Action -eq "Allow" -and $rdpRuleNames -notcontains $_.Name }

foreach ($other in $otherRules) {
    $remote = ($other | Get-NetFirewallAddressFilter).RemoteAddress -join ", "
    Write-Warning "Rule '$($other.DisplayName)' (enabled, inbound, TCP 3389) is not in the Remote Desktop group and still allows RemoteAddress $remote. Review it; this script does not change it."
}

# Report the resulting configuration.
$listener = Get-ItemProperty -Path $listenerPath
$lsa = Get-ItemProperty -Path $lsaPath

[PSCustomObject]@{
    UserAuthentication     = $listener.UserAuthentication
    SecurityLayer          = $listener.SecurityLayer
    MinEncryptionLevel     = $listener.MinEncryptionLevel
    DisableRestrictedAdmin = $lsa.DisableRestrictedAdmin
} | Format-Table -AutoSize

Get-ItemProperty -Path $policyPath |
    Select-Object -Property MaxIdleTime, MaxDisconnectionTime, fDisableCdm, fDisableClip |
    Format-Table -AutoSize

$rdpRules |
    ForEach-Object {
        [PSCustomObject]@{
            RuleName      = $_.DisplayName
            RemoteAddress = (Get-NetFirewallRule -Name $_.Name | Get-NetFirewallAddressFilter).RemoteAddress
        }
    } |
    Format-Table -AutoSize