In short
Secure remote desktop access means reaching Windows desktops and RDS hosts only after strong authentication, without RDP ports open to the internet and without putting the user on the network. Zero trust options include RDP brokers such as TruGrid SecureRDP, MFA-gated ports with Zero Networks, browser-based sessions with Keeper, and Duo MFA on RD Gateway.
Get a quote for secure remote desktop access
Tell us roughly how many users or sites you have and we will reply by email with options and a quote.
Why exposed RDP and VPN-to-RDP are risky
There are two common ways businesses provide remote desktop access, and both carry risk.
RDP published to the internet. Forwarding port 3389 (or a disguised alternative port) from the firewall to a server lets anyone who finds it try to sign in. Exposed RDP is routinely scanned for and targeted with password guessing and known vulnerabilities, and a successful sign-in lands the attacker directly on a Windows host inside your network. The NCSC lists exposing private applications to the internet as one of its four ZTNA anti-patterns.
VPN, then RDP. Putting a VPN in front of RDP removes the open port, but the VPN gateway is now the exposed service, and once a user is connected their device can usually reach far more than the one desktop they need. A stolen VPN credential, or malware on a home laptop, gets the same network access.
Zero trust RDP removes both problems: nothing listens on the internet, authentication with MFA happens before any connection reaches your network, and each user reaches only the desktops or apps they are entitled to.
Zero trust options for remote desktop
| Option | How it protects RDP | Best for |
|---|---|---|
| TruGrid SecureRDP | Users authenticate to TruGrid's cloud with MFA; components inside your network connect outbound only, so no inbound firewall ports are needed | Staff working on office PCs, RDS and RemoteApp, VDI, hosted desktops and Azure Virtual Desktop |
| Zero Networks | Admin and remote access ports stay closed until the user completes MFA; Connect opens a port only for the authenticated user's IP for a set time | Administrators and organisations also tackling lateral movement |
| Keeper Connection Manager and KeeperPAM | Browser-based RDP and SSH sessions launched from the vault without revealing the password, with session recording; KeeperPAM brokers through a gateway that connects outbound only | IT staff, privileged users and suppliers |
| Duo RD Gateway | Adds Duo MFA (Duo Push or phone call) to an existing Remote Desktop Gateway and RemoteApp connections; the gateway itself stays internet-facing | Organisations keeping Microsoft RD Gateway and already using Cisco Duo |
| Client-based ZTNA | RDP is one of the protocols a ZTNA client can carry per application; some platforms, such as Cisco Secure Access, also list browser-based RDP | Organisations moving all remote access to one ZTNA or SSE platform |
These options can be combined. A common pattern is TruGrid for everyday desktop access, with privileged access tools for administrators.
Not sure which option fits? Ask us
Tell us what you need and we will recommend the right option for your organisation, with a quote.
TruGrid SecureRDP
TruGrid SecureRDP is built specifically for remote desktop. Users sign in through TruGrid's cloud, which checks them against your directory and MFA before any connection reaches your network. TruGrid's own MFA is on by default, and it also supports MFA integrated with Microsoft Entra ID.
Inside your network, you install either TruGrid Sentry on a Windows server on the same network as the PCs or RDS hosts, or TruGrid SecureConnect on the hosts themselves where they cannot share a network with Sentry. Both connect outbound to TruGrid, so the firewall needs no inbound rules. TruGrid works with on-premises Active Directory, Microsoft Entra ID or a hybrid of both, and provides apps for Windows, Mac and mobile.
SecureRDP covers remote work on office PCs, Remote Desktop Services and RemoteApp, VDI, hosted desktops and Azure Virtual Desktop. TruGrid publishes Basic, Business and Enterprise plans: SecureRDP is licensed per user, the Business plan has a minimum user count and adds RDS monitoring through TruGrid RDS Manager, and Enterprise is sold as a site licence for large RDS and VDI estates. A trial is available for a pilot group. See our TruGrid SecureRDP page for the plans and the TruGrid SecureRDP licensing page for licensing.
Zero Networks, Keeper and Duo
Zero Networks: MFA before the port opens
Zero Networks applies least-privilege rules on each host using the host's own firewall, and can require MFA before administrative ports such as RDP open. Zero Networks Connect extends this to remote users: the remote access service has no open ports on the internet, a port opens only after MFA and only for the authenticated user's IP address, for a set time. Remote users then fall under the same segmentation policy as everyone else. See Zero Networks Connect.
Keeper: browser-based sessions with vaulted credentials
Keeper Connection Manager is a self-hosted gateway that gives users RDP, SSH, VNC and other sessions in a web browser, with no client to install and no VPN. Credentials come from the Keeper vault, so users can open a session without knowing the password, and sessions can be recorded. KeeperPAM includes Connection Manager and adds cloud-brokered sessions through the Keeper Gateway, which only makes outbound connections, plus password rotation and discovery. See Keeper Connection Manager licensing and KeeperPAM licensing.
Duo for RD Gateway
If you run Microsoft Remote Desktop Gateway and want to keep it, Duo's RD Gateway plugin adds MFA to RD Gateway and RemoteApp connections. It supports Duo Push and phone call only, and installing it disables RD Gateway's connection and resource authorisation policies (CAPs and RAPs), so those controls need rebuilding elsewhere. It also still relies on the RD Gateway being reachable from the internet, so it strengthens rather than removes the exposed service. Our Cisco Duo site covers the Duo RD Gateway integration and its caveats in detail.
Is secure remote desktop access the right fit for you?
We will check it against your systems and requirements and recommend the right option.
Steps to close inbound RDP
- Find every exposed RDP service. Check firewall port forwards, cloud security groups and any non-standard ports mapped to 3389 internally.
- List who uses each one, from which devices, and whether they need a full desktop or a single application.
- Choose the access method: an RDP broker for everyday users, privileged access tools for administrators, and browser-based access for suppliers.
- Connect your directory and enforce MFA for every remote desktop user.
- Deploy the outbound-only components (for example TruGrid Sentry or SecureConnect, or a Keeper Gateway) and allow their outbound traffic through your firewall and web filtering.
- Pilot with one team, then move users across in groups.
- Remove the port forwards and VPN access for RDP once each group is live, and confirm externally that nothing still answers.
- Review sign-in and session logs regularly, and remove access when people leave.
Closing inbound RDP also supports the firewall controls in Cyber Essentials, though certification depends on your wider controls.
How we help
We can audit your current remote desktop setup, recommend the right mix of TruGrid, Zero Networks, Keeper or Duo, arrange a trial, deploy the components, connect your directory and help you close inbound RDP. Scope and timescales are confirmed at quote, and pricing depends on users and plan, so ask us for a quote. For the wider picture, see secure remote access solutions and VPN alternatives for business. Contact us to get started.
How Forever Systems helps with ZTNA and SASE
We are an independent IT and cyber security provider. We supply and support several zero trust access and SASE platforms, so we can recommend what fits how your people work rather than one vendor's answer to everything.
- Assess first: we look at your current VPN, firewall, identity set-up and the applications people need to reach before suggesting anything new
- Vendor-aware advice across ZTNA, SSE and SASE options, including Cisco Secure Access and Check Point Harmony SASE
- Pilots and phased roll-out: we can help you start with one group of users or one application, then extend access policy by policy
- VPN replacement: planning the move away from remote access VPNs, including identity provider integration and device posture checks
- Ongoing support: policy changes, licence reviews and renewals, with the details confirmed at quote
We work with businesses, schools, charities and public sector organisations. Pricing depends on users, features and term, so ask us for a quote.
Frequently asked questions
How do I set up secure remote desktop access?
Avoid opening RDP to the internet. Use an RDP broker or zero trust access service that authenticates users with MFA in the cloud, connects to your desktops through outbound-only components, and gives each user only the desktops or apps they need. Then remove any port forwards and VPN-based RDP access.
Can I use RDP without a VPN?
Yes. Services such as TruGrid SecureRDP broker RDP sessions through the cloud with MFA and no inbound firewall ports, so users reach their desktops without a VPN. Zero trust platforms that carry RDP per application, and browser-based session tools such as Keeper Connection Manager, are other options.
Is exposing RDP to the internet safe?
No. Internet-facing RDP is routinely scanned for and targeted with password guessing and known vulnerabilities, and a successful sign-in lands an attacker on a host inside your network. Close inbound RDP and use a zero trust method instead.
What is zero trust RDP?
Zero trust RDP means remote desktop access where nothing listens on the internet, the user is authenticated with MFA before any connection reaches the network, and access is limited to the specific desktops or applications the user is entitled to.
Does secure remote desktop work with Azure Virtual Desktop?
TruGrid lists Azure Virtual Desktop among the environments SecureRDP supports, alongside office PCs, Remote Desktop Services and RemoteApp, VDI and hosted desktops.
Is Duo for RD Gateway enough on its own?
It adds MFA to Remote Desktop Gateway connections, which is a significant improvement, but the RD Gateway itself remains reachable from the internet. Organisations wanting no inbound exposure usually move to an RDP broker or ZTNA.
Still have a question about secure remote desktop access?
Ask us and a member of our team will reply by email.
More zero trust access guides
TruGrid SecureRDPZero trust remote desktop: MFA-protected RDP to PCs, RDS and virtual desktops with no inbound firewall ports.
Zero Networks ConnectRemote access with no open ports: MFA before any port opens, only for the authenticated user, under your segmentation policy.VPN alternativesSeven ways to give staff and suppliers remote access without a traditional VPN, with products for each.VPN replacementRetiring a remote access VPN: the options, an NCSC-aligned migration plan and what changes for users.Agentless ZTNAClientless ZTNA through the browser for contractors, partners and personal devices, and its trade-offs.