Remote Access to Office Computers: RDP, VPN or Remote Desktop Apps
Practice4 minInnovialabs editorial team
In short
For everyday employee work, RDP over VPN or an RDP gateway with 2FA is the safest choice; remote desktop apps suit one-off support; an RDP port open to the internet is never acceptable.
Short answer
There are three workable ways to give an employee access to an office computer from home:
- RDP over VPN — the employee first connects to the office network via VPN, then to their computer via RDP.
- RDP gateway (Remote Desktop Gateway) — RDP traffic is wrapped in HTTPS and passes through a dedicated server that checks access.
- Remote desktop apps — the connection goes through the vendor's cloud service, with no network setup.
And one unacceptable way: forwarding the RDP port on the router and connecting to the computer directly from the internet.
Why RDP must not be exposed to the internet
An open RDP port is quickly found by automated scanners. Then it begins:
- Password guessing around the clock — a weak or reused password will eventually be cracked.
- Attacks on protocol vulnerabilities: RDP has had vulnerabilities in the past that allowed attacks without a password. A missed update becomes an open door.
- An entry point for ransomware: once in one computer, an attacker moves on through the office network.
Changing the port from the default does not solve this — scanners check every port.
Comparing the options
| Criterion | RDP over VPN | RDP gateway | Remote desktop apps |
|---|---|---|---|
| Security | High: RDP is not visible from outside | High with 2FA and updates | Depends on the vendor and account settings |
| Speed and quality | Good, depends on the office line | Good | Usually good, depends on the vendor's servers |
| Setup effort | Medium: VPN server and clients | Higher: server, certificate, policies | Low |
| Cost | Mostly setup time | Licences and a server | Subscription, often per user or device |
| Best for | Everyday employee work | Many users, central control | Support, one-off sessions, small teams |
RDP over VPN
The most common choice for a small office. The VPN server runs on the router or a separate machine, and each employee has their own key or account.
What matters:
- target computers need a Windows edition that accepts incoming RDP connections (Pro or higher, not Home);
- enable NLA (Network Level Authentication);
- allow RDP in the firewall only from the VPN subnet;
- the computer must be on — disable sleep or set up Wake-on-LAN.
RDP gateway
A gateway helps when there are many users and you need central control over who connected to which computer and when. Only the gateway's HTTPS port is open to the outside; RDP itself stays inside the network. The gateway can be tied to two-factor authentication.
Downsides: it needs Windows Server infrastructure, a certificate and regular updates of the gateway itself, which becomes the internet-facing point.
Remote desktop apps
Services such as TeamViewer, AnyDesk, RustDesk and similar connect through the vendor's cloud, so they need no public IP or port forwarding. That is convenient for support and small teams.
Security rules:
- enable 2FA on accounts;
- turn off unattended access where it is not needed, or protect it with a separate strong password;
- restrict the list of allowed accounts or devices;
- check licence terms: free versions are often allowed for personal use only.
Mind the scams too: attackers call pretending to be "tech support" and ask staff to install such an app. Employees should know who in the company may ask for a remote session.
How to choose
- A few employees, everyday work — RDP over VPN.
- Dozens of users, audit requirements — RDP gateway with 2FA.
- IT support and one-off sessions — a remote desktop app.
- Only files and email are needed — maybe no remote desktop at all: cloud services may be enough.