Windows RDP, with no open port.
Exposed RDP is one of the most common ransomware entry points. SSHepherd closes port 3389 and keeps remote desktop working.
What an open windows rdp port gives away
An internet-reachable RDP endpoint is actively hunted. Access to exposed RDP hosts is bought and sold, and credential-stuffing against 3389 runs continuously against every routable address.
An RDP gateway narrows the exposure but does not remove it: the gateway itself is now the internet-facing service, and it inherits the same scanning, the same CVE exposure and the same brute-force traffic.
The port is closed, not hidden.
SSHepherd closes the listening port on the Windows host. There is no RDP socket accepting inbound connections, and no gateway standing in for one.
The host connects outbound to the SSHepherd broker. Authorised administrators authenticate at the broker and their desktop session is carried back over that outbound connection.
- Nothing listens inbound
- Access via broker only
- Every session monitored
What your customer notices
Administrators connect with the Remote Desktop client they already use.
There is no internet-facing RDP service, so nothing on that path to keep patched against the next RDP CVE.
RDP sessions can be watched in real time and terminated immediately if something looks wrong.
Sessions are recorded and exportable, which is usually what an auditor is asking for.
Watch the windows rdp demo.
SSHepherd® with Windows RDP. A recorded demo from Full Armor, the developer of SSHepherd®.
Windows RDP: common questions
Do administrators need a new remote desktop client?
No. The standard Remote Desktop client is used exactly as before. What changes is that the server no longer has an inbound listening port.
How is this different from an RDP gateway or a VPN?
Both terminate inbound connections on a service that is itself exposed and must be patched. SSHepherd has no inbound listener at all — the protected host dials out, so there is nothing on the perimeter to attack.
Can a session be cut off mid-connection?
Yes. Any active session can be terminated on demand from the SSHepherd console.
Does it work for cloud and on-premise Windows servers?
Yes — on-premise, cloud, physical and virtual hosts use the same model.