About

This article explains how to fix a failing Azure check about the Remote Desktop Protocol (RDP) port. ControlMap checks your Azure connection against its Azure Baseline Controls. One of these checks looks for network rules that allow access from any address on the internet (0.0.0.0/0) to port 3389, the RDP port for Windows servers.

Allowing public access to RDP lets attackers anywhere on the internet reach your servers and virtual instances. They can try to exploit known weaknesses in operating systems, or use brute force techniques to gain access to servers, data and information systems.

Find the failing check in ControlMap

1. Go to Monitor › Compliance Checks.
2. Find the Azure check with the status Failing. To narrow the list, use the filters at the top of the table.
3. Open the Compliance check actions menu on the check's row and select View Evidence, then open the Scan results tab to see the result.

Restrict RDP access in Azure

Do these steps in the Azure portal. Repeat them for each network security group, one at a time.

1. Sign in to the Azure portal.
2. Under resources, select Network Security Groups.
3. Select a network security group.
4. Under Settings, select Inbound security rules.
5. In the right-hand pane, review the list of security rules.
6. Remove or update any inbound rule that allows incoming traffic from the source IP 0.0.0.0/0 to destination port 3389 with the TCP protocol.

Run the scan again

1. Go to Monitor › Integrations and open your Azure connection from its card.
2. Select Run Once. A message says the scan is scheduled to start in the next few minutes.
3. When the scan finishes, go back to Monitor › Compliance Checks to see the updated status.

Connections also scan on their weekly schedule, so the status updates on its own if you don't run it manually.

More information

For more on how network security groups work, see Microsoft's network security groups overview.