IT explained · 7 min read
What is RDP? Remote Desktop Protocol explained, and its limits
Written for: IT staff choosing between RDP, a VPN and a remote support tool, or being asked to open RDP to the internet and looking for the argument against it.
RDP versus brokered access
In short
RDP, the Remote Desktop Protocol, is Microsoft's built-in method for connecting to a Windows machine and using its desktop remotely. It is efficient, well integrated and free with Windows. Its weakness is architectural: it expects a network route to the target machine, so making it work from anywhere usually means either a VPN or exposing a listening service to the internet, and the second option is one of the most reliably exploited mistakes in IT.
Key takeaways
- RDP is built into Windows, listens on TCP 3389 by default, and needs a network route to the target machine.
- It is excellent inside a network or over a VPN for administering servers and full-desktop work.
- RDP exposed directly to the internet is scanned constantly and is a leading route for ransomware.
- Windows editions matter: Home editions can connect out but cannot host an incoming session.
- Brokered remote support tools invert the model: the agent dials out, so nothing listens on the internet.
What RDP is
RDP is a protocol Microsoft ships with Windows that streams a desktop session to a remote client. Rather than sending video, it sends drawing instructions and only the parts of the screen that changed, which is why it performs well on modest connections. It also carries the extras a real working session needs: clipboard, printers, drive redirection, audio and multiple monitors.
The server component listens on TCP 3389 and is present in Professional, Enterprise and Server editions of Windows. Home editions include the client but not the host, which is a frequent surprise when someone tries to connect to a home machine.
What it is genuinely good at
Inside a network, or across a VPN, RDP is hard to beat for full-desktop work. Server administration, long sessions in a line-of-business application, and desktop-as-a-service deployments all suit it. It is included in the licence you already own, it is well understood, and it survives brief network interruptions by reconnecting to the existing session.
It is also the foundation of Remote Desktop Services and virtual desktop platforms, so understanding it is not optional even in estates that also run a separate support tool.
The architectural problem
RDP assumes the client can reach the server. On a corporate LAN that is true. From a technician's home, a client site or a mobile connection, it is not, and there are only three ways to change that: connect through a VPN, publish RDP through a gateway that authenticates first, or open port 3389 through the firewall to the machine.
The third option is the dangerous one, and it remains common because it is the quickest. Internet-wide scanners find exposed RDP within minutes of it appearing. Once found, it faces continuous credential stuffing and brute-force attempts, and every RDP vulnerability disclosed in recent years has been weaponised quickly. Exposed RDP is consistently among the top initial-access routes in ransomware cases.
- Never publish 3389 directly to the internet, on any port number. Changing the port only slows a scanner down.
- Use a VPN or an authenticating gateway such as Remote Desktop Gateway, and require multi-factor authentication.
- Enable Network Level Authentication so credentials are validated before a session is established.
- Restrict who can log on remotely, and never use a shared administrator account for it.
- Log and review remote logons. Unusual hours and unusual source addresses are the useful signals.
How brokered remote support tools differ
Modern remote support and RMM tools reverse the direction of the connection. A small agent on the managed device makes an outbound TLS connection to a cloud service and holds it open. When an operator asks for a session, the service pairs the two sides. Nothing on the managed device listens for inbound traffic, so there is nothing on the internet to scan or brute-force.
That single difference explains most of the practical advantages: no firewall changes, no VPN for support work, devices reachable on home and mobile networks, and connections that work identically wherever the device is. It also brings a proper access model, with per-operator accounts, permissions and an audit trail of who connected to what and when, which local RDP accounts do not provide.
Choosing between them
This is not usually an either-or. RDP inside the network for server administration and full-desktop work, plus a brokered tool for supporting devices that are anywhere else, is a common and sensible combination.
The line to hold is the exposure one: whatever you use, nothing should be listening for inbound remote-access connections on a public address. If your only route to a home worker's laptop today is a forwarded port, that is the thing to replace first.
RDP versus brokered remote support
| Connection direction | RDP inbound to the device; brokered agents dial outbound |
|---|---|
| Firewall changes | Usually required for RDP; none for brokered access |
| Works off-network | Only via VPN or gateway; brokered works anywhere with internet |
| Cost | Included with Windows; brokered tools are licensed separately |
| Non-Windows devices | Limited; brokered tools are typically cross-platform |
| Audit trail | Windows event logs; brokered tools log sessions per operator |
| Attack surface | A listening service if exposed; nothing listening with brokered access |
Select any column heading to sort, or filter with the box above.
Common mistakes
- Moving RDP to a non-standard port and treating that as security. Scanners sweep all ports.
- Allowing remote logon for a broad group, so any compromised account becomes remote access.
- Forgetting Windows Home editions cannot host a session, then blaming the network.
- Leaving a temporary firewall rule in place after the emergency that justified it.
Frequently asked questions
- What is RDP used for?
- Connecting to a Windows machine and using its desktop remotely: administering servers, running line-of-business applications, and delivering virtual desktops.
- What port does RDP use?
- TCP 3389 by default. Changing it does not meaningfully protect an exposed service, because scanners check all ports.
- Is RDP secure?
- The protocol itself supports strong encryption and Network Level Authentication, so it is reasonable inside a network or behind a VPN or gateway. Exposed directly to the internet it is one of the most attacked services there is.
- What is the difference between RDP and remote desktop software?
- RDP is a protocol built into Windows that expects a route to the machine. Remote desktop and support products usually broker the connection through a cloud service, with the agent dialling out, so no inbound access is needed.
- Can I use RDP over the internet safely?
- Only through a VPN or an authenticating gateway with multi-factor authentication. Publishing port 3389 to the internet should be treated as not an option.
Why teams choose 247connect
Nothing listening on the internet
Agents make an outbound encrypted connection, so there is no exposed port for scanners to find and no firewall rule to justify.
Around eight seconds to a session
No VPN client to start and no gateway hop, so support work begins immediately.
Works wherever the device is
Home broadband, mobile tethering or a client site all behave the same way.
Per-operator accounts and audit
Every session is attributable, which shared local administrator accounts on RDP hosts cannot deliver.
Fixed, predictable pricing
Unlimited operators with five concurrent sessions each, so support coverage does not become a licensing exercise.
Where RDP fits the job inside your network, use it. For the devices that are somewhere else, 247connect gives brokered zero-trust access with AES-256 encryption and no inbound ports, which is the part RDP was never designed to do.
More IT explainers
What is an endpoint?
An endpoint is any device that terminates a network connection and can be managed, monitored and attacked: laptops, desktops, servers, tablets, phones, tills and kiosks. What counts, what does not, and why the count matters commercially.
What is bandwidth?
Bandwidth is how much data a connection can carry at once, measured in megabits per second. It is not speed, and it is not the reason most remote sessions feel slow. What bandwidth is, how it differs from latency, and how much a remote session actually needs.
What is a node in networking?
A node is any device with a network address that can send, receive or forward data: computers, servers, phones, printers, switches, routers and cloud gateways. What counts as a node, how nodes differ from endpoints, and why node counts appear on invoices.