HighOS hardeningBLWK-WIN-006

Remote Desktop is on without Network Level Authentication

What this means

Remote Desktop accepts connections, and without Network Level Authentication anyone who can reach it gets a login screen — and the pre-authentication attack surface — before proving who they are.

How to fix it

Turn on Require devices to use Network Level Authentication in Settings → System → Remote Desktop, or turn Remote Desktop off if you don't use it. Limit it to your VPN or private network.

Check it yourself

Run a scan and look for BLWK-WIN-006 in the results:

bulwark scan

Installed the standalone CLI package instead of the app? The command is bulwarkctl.

How Bulwark decides

Bulwark reads windows_security and reports this check when:

rdp_enabled_known == true and rdp_enabled == true and rdp_nla_known == true and rdp_nla == false

If a value can't be read, Bulwark reports the check as undetermined rather than passing it. View the rule source.

References

• MITRE ATT&CK T1021.001

Related checks

• Cron entry runs a downloader piped to a shell · BLWK-ACCT-001
• Password maximum age is excessively long · BLWK-ACCT-002
• Password minimum age is zero · BLWK-ACCT-003
• Password hashing rounds are not explicitly configured · BLWK-ACCT-004
• Default UMASK is not explicitly configured · BLWK-ACCT-005
• A sensitive system file is world-writable · BLWK-FS-001