Walkthrough Demonstrates Seven Ways to Enable RDP Remotely on a Windows Domain Controller

Summary

A hands-on walkthrough demonstrates seven ways to enable RDP on a Windows Server 2019 domain controller using credentials or hashes over SMB, WMI, WinRM, and RPC, then connect from Kali; it also outlines hardening and detection measures.

Key points

The walkthrough demonstrates seven methods for enabling RDP on a Windows Server 2019 domain controller, using NetExec, Impacket, Evil-WinRM, Samba RPC, and Metasploit.
The techniques use valid credentials or NTLM hashes and operate through SMB, WMI, WinRM, or RPC.
The article shows connections to the enabled system using rdesktop, xfreerdp3, and Remmina; one example uses Pass-the-Hash.
Recommended defenses include credential rotation with LAPS, restricting NTLM, hardening remote management protocols, and limiting RDP access through approved gateways.
Suggested monitoring includes alerts for changes to fDenyTSConnections and Windows events associated with logons, remote execution, and service creation.

Article Details

Topic: Demonstration of techniques for remotely enabling RDP on a Windows Server 2019 Domain Controller and connecting to it, with defensive mitigation and detection guidance.

MITRE ATT&CK

T1021.001 · Remote Desktop ProtocolRDP is enabled on the Domain Controller and then used to establish remote desktop sessions.T1021.006 · Windows Remote ManagementEvil-WinRM is used to establish a remote WinRM session and change the RDP setting.T1047 · Windows Management InstrumentationNetExec is described as enabling RDP through WMI on the remote Domain Controller.T1059.001 · PowerShellA PowerShell command is run remotely through the Evil-WinRM session to change the RDP setting.T1112 · Modify RegistryThe demonstrated methods modify the fDenyTSConnections registry value to enable RDP.T1550.002 · Pass the HashPass-the-Hash authentication is demonstrated using an NTLM hash to execute commands and connect over RDP.T1569.002 · Service ExecutionImpacket-psexec uploads and starts a service on the target to provide a SYSTEM-level shell.

Products

Windows Server 2019This article walks through multiple real-world techniques to remotely enable RDP on a Windows Server 2019 Domain Controller (DC.ignite.local) and demonstrates connecting to it from Kali Linux using rdesktop, xfreerdp3,

Tools

Evil-WinRMIt covers seven exploitation methods — NetExec, Pass-the-Hash wmiexec, Impacket utilities, Evil-WinRM, Samba net rpc, and a Metasploit post module — and provides targeted mitigation and detection guidance.ImpacketIt covers seven exploitation methods — NetExec, Pass-the-Hash wmiexec, Impacket utilities, Evil-WinRM, Samba net rpc, and a Metasploit post module — and provides targeted mitigation and detection guidance.Metasploit FrameworkMetasploit Framework’s post-exploitation module provides an automated, menu-driven approach to enabling RDP from within an active Meterpreter session.NetExecIt covers seven exploitation methods — NetExec, Pass-the-Hash wmiexec, Impacket utilities, Evil-WinRM, Samba net rpc, and a Metasploit post module — and provides targeted mitigation and detection guidance.NmapNmap Port Scan rdesktopServer 2019 Domain Controller (DC.ignite.local) and demonstrates connecting to it from Kali Linux using rdesktop, xfreerdp3, and Remmina.Remmina(DC.ignite.local) and demonstrates connecting to it from Kali Linux using rdesktop, xfreerdp3, and Remmina.Samba netIt covers seven exploitation methods — NetExec, Pass-the-Hash wmiexec, Impacket utilities, Evil-WinRM, Samba net rpc, and a Metasploit post module — and provides targeted mitigation and detection guidance.xfreerdp3Domain Controller (DC.ignite.local) and demonstrates connecting to it from Kali Linux using rdesktop, xfreerdp3, and Remmina.