Remote Desktop Protocol is the standard that carries a graphical desktop session between a person and a remote computer.
It lets someone see and operate a desktop as if they were sitting at that machine, which is powerful and risky.
How it works
Administrators use it for support and for servers that still need a graphical console.
Attackers want the same path because a stolen password or an exposed service can hand them a full desktop.
The safe pattern is to keep the service off the open internet, require strong sign in, and watch for logons from unusual places.
This page does not describe how to break into a desktop.
Concrete examples
- A support engineer opens a managed desktop to fix a finance application during a change window.
- A forgotten server exposes the desktop port to the internet and collects failed logons all night.
- A contractor account is used from a new country hours after the contractor has left the project.
Protective measures
- Place remote desktops behind a private access method and do not publish them directly to the internet.
- Require multifactor sign in and unique accounts so a shared password cannot open every server.
- Alert on logons outside expected hours or from regions where your staff do not work.
- Remove desktop access when a contract ends and review which servers still listen for it.
Related articles
What is a red team? explains an authorized exercise that may check whether exposed remote desktops are noticed.
What is pentesting and how does scoping work? explains scoping an authorized test, which should say whether remote desktops are included.
What is a risktool? explains dual use remote administration software that can resemble a desktop support tool.