RDP on work computer

Jump to latest Follow Reply
H

hal_incandenza

Ars Centurion
328
  • #1
    My work from home setup for the last few years has been connecting my work laptop to my local network, and then connecting to it using RDP from my desktop. This way I have one keyboard/mouse and share the same monitors. "Going to work" is just opening RDP and stopping work is just minimizing/closing the RDP window.

    Got a new laptop recently, and RDP connections are not enabled. I asked IT to enable it and they are giving me a hard time about it. I feel like if they are OK with my work laptop being on my home network, connecting to it with RDP from within my LAN is less of a security risk than just being on my LAN in the first place. Am I wrong about that? Any advice on the arguments I can make in favor of it not being an unacceptable security risk?
     
    Paladin

    Paladin

    Ars Legatus Legionis
    32,552
    Subscriptor
  • #2
    It's their property and their security policy. Not much you can do. If you have asked nicely and explained how it helps your work flow and they still denied it, you are pretty much done. Get a cable to your monitor and see if you can use the Microsoft power toy to share a mouse and keyboard on 2 computers. Otherwise maybe a USB switch to switch mouse and keyboard between the machines.
     
    H

    hal_incandenza

    Ars Centurion
    328
  • #3
    It's a pretty non-traditional workplace, I work in the front office for a pro sports team. So while we have an IT department, we are not necessarily completely at the mercy of their policies. Within reason I can escalate to my bosses and override things they decide on, and we have had to do so in the past.

    The bosses also have a pretty low opinion of their competence because of a number of issues we have had with them. A couple of examples to illustrate the magnitude: our main point of contact is a director level employee who manages our server infrastructure, and he routinely ghosts us when we have important issues that need solving. Will completely ignore emails and Teams messages and follow ups for days/weeks on end. The most unprofessional behavior I've ever seen. The same guy occasionally reaches out to say he needs to install Microsoft security patches on our production database server that also runs a bunch of ETL/report automation. Multiple times, despite our explicit instructions to only install OS/MSSQL patches, he has just blindly clicked the "Update All" button in the program he uses to identify software with updates available, and taken down our entire reporting system by hosing our installation of R and the packages we use. Professional head coaches do not accept "well IT upgraded R when we told them not to and introduced breaking changes so nothing works until we can roll back" as an answer why they didn't get their reports.

    It also is not officially their policy. When I asked them to enable it I was at home on VPN, and they kind of embarrassed themselves. First the tech who took over my machine was unable to find the setting to enable RDP connections and I sat there watching him fumble around for 5 minutes until I just opened it for him. Then the director from above tried to do it and got stuck when he couldn't see the admin password popup using the software to take over my machine. They recently took away local admin rights, so this raised an even bigger issue that they are unable to do something that requires admin rights when someone is remote on VPN. That's a major problem because half of my staff works remote. Only when he realized that did he try to save face and say "actually I'm not going to do this because security". They already knew I'd been doing this for years and changed their minds on a dime when they got caught in this rather untenable situation.

    Long story short, I can potentially force an override to their policy, I just need to be armed with reasonable arguments about the security of doing it.
     
    Paladin

    Paladin

    Ars Legatus Legionis
    32,552
    Subscriptor
  • #4
    The only reasonable argument I would have is, "You folks already have shown that you have no idea what you're doing so this is the least of your worries."

    I don't think that will go over very well.

    Disabling remote desktop access to company devices is a fairly reasonable security measure in general so I don't have much of a suggestion other than "I need this to do my job effectively." But if you try that angle, I'm sure they could easily say, "No you don't, you can just use the built in display and keyboard like everyone else."

    Personally, I would not make it into a fight unless it really means that much to you. I would simply plug it into another input on the main monitor you want to use and get a wireless keyboard and mouse for it and call it a day. Or use the microsoft power toy to share the mouse and keyboard, if they will let you install that.
     
    Andrewcw

    Andrewcw

    Ars Legatus Legionis
    18,129
    Subscriptor
  • #5
    They don't need to tell you or write down their official policy. What you don't want to be is the Goat in this situation. The Scape variety. Because the worst that can happen is they lose your company's contract. Which is probably not the end of the world for them.

    Maybe because of all the RDP flaws and exploits they decided to step up the security game. It's a work assigned laptop. Or maybe they finally caught wind of outsourcing scams that probably were industrial espionage. In which they decided to change policy and not really need to tell you about it.

     
    K

    koala

    Ars Tribunus Angusticlavius
    7,579
  • #6
    If someone owns your personal device, then they can own the computer you are RDP'ing to. This creates an additional risk. (In fact, using Mouse Without Borders, as suggested above, would have more or less the same effect under certain circumstances). The importance of that risk is more debatable, and much more scenario-dependant, and how much under threat is the IT infrastructure in question.

    (Unfortunately, though, ransomware instantly increased the risk profile of all kinds of IT infrastructure, no matter how small or non-important they are.)
     
    H

    hal_incandenza

    Ars Centurion
    328
  • #8
    Andrewcw said:
    They don't need to tell you or write down their official policy. What you don't want to be is the Goat in this situation. The Scape variety. Because the worst that can happen is they lose your company's contract. Which is probably not the end of the world for them.

    Maybe because of all the RDP flaws and exploits they decided to step up the security game. It's a work assigned laptop. Or maybe they finally caught wind of outsourcing scams that probably were industrial espionage. In which they decided to change policy and not really need to tell you about it.

    Click to expand...
    There is no contract to lose, we are all directly employed by the team. The entire purpose of our existence is to operate the team and win games. There are no outsourcing scams, we are a very small staff running a professional sports team. This IT staff exists solely to support the operations on the sports side, i.e. provide and service hardware and software for us.
     
    Paladin

    Paladin

    Ars Legatus Legionis
    32,552
    Subscriptor
  • #10
    Right, but the replies you have given show you are not considering the potential security issues.

    The most common security problems that happen on corporate networks/resources are often caused by users who install/execute/click on things they should not touch or things they might not even see which can use zero-day attacks, drive-by attacks, etc.

    Since the IT team can't control what you do with your personal PC or what updates and security measures you have on it, they do not want to allow your persona PC to have access to the work PC, especially something like remote desktop where it would provide very high level access to the work PC, especially if you save your password or keep the session open or something like that.

    You could simply open the wrong email, or see the wrong ad on a web page on your personal PC, and then your work PC is suddenly owned by remote bad guys who could exfiltrate corporate data over the remote desktop session, use the access to get into corporate network assets and lock/encrypt, and exfiltrate them, extort the team, use the data to do any number of other bad things, and you would never know it until it is too late.

    What you are asking for is reasons to override/evade a very reasonable IT policy because it causes you a very minor inconvenience. Actually I am not sure what inconvenience it causes you at all other than 'I like my way of doing it because I always did it this way'. What is the issue with simply connecting the work PC to your monitor and a second keyboard and mouse, or just using the keyboard on the work PC? If you just want it to be out of sight, then use a longer video cable and wireless keyboard and mouse. It's very easy.
     
    • Like
    Reactions: m0nckywrench and continuum
    moosemaimer

    moosemaimer

    Ars Scholae Palatinae
    717
  • #11
    I wonder if anyone makes a combination laptop dock/KVM switch...

    51C6KeFNyJL._SL160_.jpg
    +
    kvm-switch-compact-usb-audio-2-port-p383-1627_thumbmini.jpg
     
    O

    oikjn

    Ars Scholae Palatinae
    969
    Subscriptor++
  • #12
    Disabling RDP isn't an unreasonable security policy given the number of historical vulnerabilities tied to it. Since what you said of the IT team makes them sound like they are just checking boxes... how strict are they about installation of additional software? Have you considered using VNC instead of RDP? Also... did they disable the "request assistance" app? You could try using that as a back door way to RDP onto the device.
     
    H

    hal_incandenza

    Ars Centurion
    328
  • #13
    Paladin said:
    Right, but the replies you have given show you are not considering the potential security issues.

    The most common security problems that happen on corporate networks/resources are often caused by users who install/execute/click on things they should not touch or things they might not even see which can use zero-day attacks, drive-by attacks, etc.

    Since the IT team can't control what you do with your personal PC or what updates and security measures you have on it, they do not want to allow your persona PC to have access to the work PC, especially something like remote desktop where it would provide very high level access to the work PC, especially if you save your password or keep the session open or something like that.

    You could simply open the wrong email, or see the wrong ad on a web page on your personal PC, and then your work PC is suddenly owned by remote bad guys who could exfiltrate corporate data over the remote desktop session, use the access to get into corporate network assets and lock/encrypt, and exfiltrate them, extort the team, use the data to do any number of other bad things, and you would never know it until it is too late.

    What you are asking for is reasons to override/evade a very reasonable IT policy because it causes you a very minor inconvenience. Actually I am not sure what inconvenience it causes you at all other than 'I like my way of doing it because I always did it this way'. What is the issue with simply connecting the work PC to your monitor and a second keyboard and mouse, or just using the keyboard on the work PC? If you just want it to be out of sight, then use a longer video cable and wireless keyboard and mouse. It's very easy.
    Click to expand...
    I mean, in the OP I asked a question. I was not sure of the level of relative risk, and multiple people have answered the question. I am not asking to "evade" anything, I was asking if my assessment of the risk was wrong or not, and if it wasn't I was asking for some justification to bring them. They were perfectly fine with me connecting this way until I had to ask them to enable it on my new laptop and they embarrassed themselves fumbling around trying and failing to do it and then pivoted to saying it was a risk, that is part of why asked, because they'd never brought up security in the past when I told them this is how I worked at home.

    These same techs also told me installing Microsoft PowerToys was a security risk, and raised a skeptical eye at me installing Python packages with Conda. I have three Ubuntu servers on our LAN, with root access, one of which is exposed to the internet to run our internal website, and they don't know anything about Linux so luckily I'm able to stay under the radar there. I'm pretty justified in being skeptical of them on these things, even if they stumbled into maybe being correct on this one. It's hard for me to overstate the level of incompetence we've dealt with from this staff for years. For some reason pro sports teams do a very poor job of finding and retaining this kind of talent, it's one of the most common complaints from my colleagues around the league in our Slack group.

    I am essentially on call 24/7 and my work on nights and weekends is sporadic and unpredictable, I am constantly flipping back and forth between work and my personal machine. I have a very small home office and only room for one setup, and two monitors are crucial to productivity. My personal desktop is tucked away under my desk with the Logitech mouse dongle on the back to keep the front USB ports free for connecting drives etc. It is awfully presumptuous of you to call it "a very minor inconvenience", it is orders of magnitude more annoying and tedious to disconnect my desktop setup a dozen times over the course of a weekend to share it with my laptop, rather than simply opening or minimizing the RDP window. I mean, we have threads here all the time of people asking the best way to do exactly this because there isn't a great solution that makes it seamless, and myself and others have suggested this exact setup.
     
    Paladin

    Paladin

    Ars Legatus Legionis
    32,552
    Subscriptor
  • #14
    hal_incandenza said:
    I mean, in the OP I asked a question. I was not sure of the level of relative risk, and multiple people have answered the question. I am not asking to "evade" anything, I was asking if my assessment of the risk was wrong or not, and if it wasn't I was asking for some justification to bring them.
    Click to expand...
    You suggested you could have the company management/ownership 'shout down' the IT staff to give you what you want. That is 'evading' to me, I don't mean it in a bad way, it's just the word I would use to describe a situation where you get what you want despite a reasonable policy that would otherwise apply to your situation. No different from a child who asks dad and, when told no, goes to ask mom to override.

    You can call it anything else you like but many of the posters here are IT professionals so this kind of situation is a daily issue, a dance of accessibility vs. security and it is delicate, frustrating and never ending for everyone involved. Good IT professionals try to satisfy user needs but security is also a user need even if they don't think about it most of the time. Companies have shut down or lost millions over relatively stupid security incidents, and about 7 of 10 times they start with employee remote access or assets that are used or accessed inappropriately.

    hal_incandenza said:
    They were perfectly fine with me connecting this way until I had to ask them to enable it on my new laptop and they embarrassed themselves fumbling around trying and failing to do it and then pivoted to saying it was a risk, that is part of why asked, because they'd never brought up security in the past when I told them this is how I worked at home.
    Click to expand...
    Obviously I don't know the specifics of the situation but I can definitely imagine a scenario where they initially tried to do what you asked since 'it always worked before', then when they couldn't find the option to enable it they asked for help from a coworker who replied, "You shouldn't do that anyway, we have a new policy."

    Or maybe you are right and they simply decided it was not worth the effort to do something they knew they probably should not do anyway and used it as a convenient excuse to get out of the situation. In any case, it's your employer so if you want to pursue it, that is fine. The technical issues are fairly clear: RDP presents a minor to moderate security risk depending on the configuration and environment where you use it especially in relation to the systems that can connet to it (your personal machine).

    If the company has decided to start disallowing it, that's their prerogative. Whether it is out of a genuine concern for security or just partly that and largely laziness or inability to quickly enable what you want is kind of immaterial unless you want to call them out as incompetent and base your argument for access on that rather than the technical merits of allowing you access.

    hal_incandenza said:
    These same techs also told me installing Microsoft PowerToys was a security risk, and raised a skeptical eye at me installing Python packages with Conda. I have three Ubuntu servers on our LAN, with root access, one of which is exposed to the internet to run our internal website, and they don't know anything about Linux so luckily I'm able to stay under the radar there. I'm pretty justified in being skeptical of them on these things, even if they stumbled into maybe being correct on this one. It's hard for me to overstate the level of incompetence we've dealt with from this staff for years.
    Click to expand...
    Previous bad behavior doesn't really justify continued bad behavior. Just because you've been allowed to do things that are generally considered questionable or potentially dangerous in the past does not mean you should be allowed to continue to do so. And the fact that the IT team may be or was incompetent is not an argument that they should continue to be irresponsible and allow problems to go unchecked.

    I agree that it is frustrating to have to modify workflow or to deal with seemingly overly complicated methods and systems in the name of security but it often goes even beyond actual security into the realm of security theater too. Companies actually have to jump through stupid policy hoops to qualify for business continuity insurance, PCI (credit card), SAS/SOC and other certifications, etc. These policies you are running up against may be fluff the IT team has just decided on their own or they may be the beginning of a new attempt at compliance with requirements that were supposed to be in place years ago and have been ignored until now. Non-compliance may have resulted in fines or something, people getting fired or actual security breaches that have been kept quiet.

    Unless you are involved at the high levels of management you may never know, you'll only see the frustrating part where suddenly there are new rules on a bunch of things that used to be easy. Hopefully this may actually be a sign of improvement on the part of the IT team and that they are getting better training and management and will do a better job. Unlikely, maybe, but you never know.
     
    Last edited:
    Paladin

    Paladin

    Ars Legatus Legionis
    32,552
    Subscriptor
  • #15
    Second reply for character limit:

    hal_incandenza said:
    For some reason pro sports teams do a very poor job of finding and retaining this kind of talent, it's one of the most common complaints from my colleagues around the league in our Slack group.
    Click to expand...
    That is a common complaint in all business areas. IT work is largely thankless, tremendously complex and stressful and for a long time was underpaid because the people doing it happily took their work home because they have/had a passion for it (and no social life to interfere). It has changed over the last 10 years or so as work/life balance and corporate cultures have changed. In the most successful organizations, IT is now seen as an enabler of success or even an investment center for the growth of the company, where before it was always seen as simply a cost center where money went in and problems came out along with email and cat videos.

    The other issue may be that what you describe sounds like an outsourced team or IT management group who is paid to minimize support costs, maximize 'uptime' and has relatively little buy-in on the acutal business of the company/team organization. If so, it is not surprising that you are getting a relatively low quality experience (which basically lines up with the money put into it). Such services are basically based on the concept of the company paying the outsourced group somewhere around the cost of a single low to mid level employee salary and in return they get 24/7 support access, and theoretically the experience and education/skill of a whole team of professionals.

    The truth is that you get 24/7 access to level 1 support who is trained to help with email or web page issues or basic Windows questions, etc. while also providing the same level of support to 5 or 10 other companies, or more.

    You can get more/better support from them but you probably have to escalate the issue and wait for someone higher up to call/email back. Having 'in house' IT is almost always better but then you have to pay for at least 4-7 team members and pay enough to keep them around more than a year or two. In that kind of situation, my advice would be to be polite and patient and simply insist that you need to have an answer to your question/issue until they provide it. Of course, if the answer is 'policy says you can't do that' then you only have the option of addressing the policy and whoever created it.

    Another factor is the way you described that you have previously had IT decisions overwritten by management. It's not surprising you have a hard time retaining people if that happens on a regular basis (which you seemed to indicate was the case). Yes, there needs to be a negotiation for some things, like I mentioned the access vs. security issue, and other things like that. Money vs. return, etc. But if IT sets a reasonable policy for security and then management overrides it for personal reasons or to satisfy 'we always did it this way before' style arguments, the IT team will feel undermined and will leave for another place where they are treated as a valuable part of the organization and you'll have to hire new people. In that kind of environment, the people who stay around will be low-performers who want to ride it out until retirement and care little for the quality of the work or the benefit of the organization in the long run. Eventually you filter out all the good people and are left with a team of uninterested chair-fillers who do the minimum to make complaints go away before the day ends and they can go home and that's about it.

    hal_incandenza said:
    I am essentially on call 24/7 and my work on nights and weekends is sporadic and unpredictable, I am constantly flipping back and forth between work and my personal machine. I have a very small home office and only room for one setup, and two monitors are crucial to productivity. My personal desktop is tucked away under my desk with the Logitech mouse dongle on the back to keep the front USB ports free for connecting drives etc. It is awfully presumptuous of you to call it "a very minor inconvenience", it is orders of magnitude more annoying and tedious to disconnect my desktop setup a dozen times over the course of a weekend to share it with my laptop, rather than simply opening or minimizing the RDP window. I mean, we have threads here all the time of people asking the best way to do exactly this because there isn't a great solution that makes it seamless, and myself and others have suggested this exact setup.
    Click to expand...
    I can imagine your situation and that is why I suggested you simply connect the second computer to the monitor(s) and use a separate mouse and keyboard. Keep them in a drawer or in a cable management sling under the desk surface or whatever meets your needs. The switch from one computer to the other is a simple input change on the monitor.

    If that doesn't work then you could use a USB switcher to change the keyboard and mouse from one computer to the other, assuming you want to keep the one keyboard and mouse.

    Ultimately, the answer to your original question was, "No there are no technical reasons why RDP should be enabled, and yes there are technical/security reasons why it should not be enabled even for access only from your home PC." which leaves you arguing with the IT staff and management solely over your personal convenience and how it affects your work process/efficiency. That is still a legit argument. Heck, maybe you can get them to buy you a bigger desk or an OLED TV as monitor so you can use the remote to switch inputs or something.

    I can completely understand why your situation is frustrating, I actually work in a very similar way using remote desktop to an office PC where most of my resources are but I have to connect via VPN to the office and it can be a frustrating extra step because it can make other things on my network stop working while I connect to the office VPN, etc. That's why I described it as a minor inconvenience. You're not having to drive to the office to do work at night, you're not having to give a blood sample for authentication, and you're not having to crank start a diesel generator to power up your devices. You're having to, at most, shuffle a keyboard and mouse on your desk for a couple of seconds. I know compared to a click of the mouse it seems annoying but compared to a potential security breach of the organization which could result in days or weeks of downtime, and the loss of millions of dollars in damages or exfiltration of your employee data or that of others, it's really darn minor.
     
    H

    hal_incandenza

    Ars Centurion
    328
  • #16
    I think the big gap here is that I have not adequately described the incompetence of the existing staff, and the unique setup of how sports teams operate. This part:

    Paladin said:
    You're not having to drive to the office to do work at night,
    Click to expand...
    is actually not true, I do have to do that. It's happened multiple times that I have had to do so because of IT breaking something or just not knowing how to solve a problem. I work in an environment where I have to be available at all times and be able to solve any issue management might have, but I am dependent on an IT staff that is not up to the challenge. When I have to to get something done it's non-negotiable, I have gotten out of bed and gone into the office quite a few times.

    You suggested you could have the company management/ownership 'shout down' the IT staff to give you what you want. That is 'evading' to me
    Click to expand...

    Indeed, just because that's what we've had to do in the past to get the bare minimum of support.

    I think my workplace is just sort of unique in a way that doesn't jive with the norm, and this wasn't really the right forum to ask my question. I understand that RDP has issues, it's just that our staff inspires no confidence whatsoever that they know what they are doing. We have no confidence that they are better suited to secure our network than what we could do on our own. It's a shitty situation
     
    Paladin

    Paladin

    Ars Legatus Legionis
    32,552
    Subscriptor
  • #17
    I get that you have to go in on occasion, my point was that having to go from using RDP to having to use the computer with a cable to your monitor is still extremely convenient compared to having to go into the office. :)

    Are you saying they are not an outsourced team and are employed directly by the organization as full time employees? If so, why have they not been replaced with more skilled workers? When you have direct control of the employees you should be able to set performance goals/minimums and KPIs that they need to meet (department ratings, etc.) that can result in incentives for better results or replacement for underperformers. Same as team players for a sports team, if they don't excel, you trade/drop their contract. If their department head doesn't provide this kind of ongoing improvement process, then (like a failing coach) you drop that department head.
     
    N

    Nulls

    Ars Tribunus Militum
    2,451
  • #18
    A lot of dumb decisions around IT comes from outside of IT.

    The only post where they don't know what a ODBC driver is something I would expect from a someone on a service desk but even in that case anyone in IT should take a minute to google that first, its not that hard.

    If you have a inbound public accessible linux server on the lan that IT is unaware of then that also sound like a red flag to me.

    As far as RDP that is the solution you came up with, it is not the only solution. I think in this situation VDI would work the best and offer the ability for you to work on a cloud pc anywhere you have a good network whether its at home or in a office. The issue with VDI these days is cost. In the past it was very complex to implement and maintain but there are a lot of easy to use solutions out there.

    But you either need to get up the IT chain to someone who knows what they are talking about or take it up the organization chain to better provide you with the resources you need enable you to do your job function. You shouldn't have to do it all on your own and trying to do all this stuff on your own could put the organization and/or yourself at serious risk if anything bad happens.
     
    H

    hal_incandenza

    Ars Centurion
    328
  • #19
    Paladin said:
    I get that you have to go in on occasion, my point was that having to go from using RDP to having to use the computer with a cable to your monitor is still extremely convenient compared to having to go into the office. :)

    Are you saying they are not an outsourced team and are employed directly by the organization as full time employees? If so, why have they not been replaced with more skilled workers? When you have direct control of the employees you should be able to set performance goals/minimums and KPIs that they need to meet (department ratings, etc.) that can result in incentives for better results or replacement for underperformers. Same as team players for a sports team, if they don't excel, you trade/drop their contract. If their department head doesn't provide this kind of ongoing improvement process, then (like a failing coach) you drop that department head.
    Click to expand...

    Correct, not outsourced, all direct employees. Sports teams are strange organizations. I've worked for two teams, with 6 different executive groups across the two, and IT is often just a bare minimum just enough to get things done kind of situation. They also report directly to the CFO here, who is clueless about technology. We don't have a CTO.

    But the other thing about sports teams is that there are two very distinct parts of the company, the sports side and business side. We're in the same building, but literally with two basketball courts in between us. Very little interaction or overlap between the two sides, other than IT needing to support both sides. And generally speaking the sports side does our own thing. We don't have to bother with most HR formalities, we don't have a time-keeping system, we don't formally request or track PTO. And up until now, my part of the sports side, analytics, we are given a long leash to manage our own systems.

    From talking to someone who knows things, what I've found out is that the CFO wants to get PCI compliant, to save on insurance and also to allow the org to do their own credit card processing. And so they are trying to do it without segmenting us off as our own thing, even though we have no access or interaction with systems over there
     
    • Like
    Reactions: RGrizzzz
    H

    hal_incandenza

    Ars Centurion
    328
  • #20
    Nulls said:
    A lot of dumb decisions around IT comes from outside of IT.

    The only post where they don't know what a ODBC driver is something I would expect from a someone on a service desk but even in that case anyone in IT should take a minute to google that first, its not that hard.

    If you have a inbound public accessible linux server on the lan that IT is unaware of then that also sound like a red flag to me.

    As far as RDP that is the solution you came up with, it is not the only solution. I think in this situation VDI would work the best and offer the ability for you to work on a cloud pc anywhere you have a good network whether its at home or in a office. The issue with VDI these days is cost. In the past it was very complex to implement and maintain but there are a lot of easy to use solutions out there.

    But you either need to get up the IT chain to someone who knows what they are talking about or take it up the organization chain to better provide you with the resources you need enable you to do your job function. You shouldn't have to do it all on your own and trying to do all this stuff on your own could put the organization and/or yourself at serious risk if anything bad happens.
    Click to expand...
    It's not that they are unaware of my Linux servers, they had to spin them up for me in VMware. It's that they only know enough to spin up the server and give me credentials, and don't seem to realize that me having root on these boxes is much more permissive than giving me an admin password for my Windows laptop so I can install ODBC drivers and update to a new version of PowerToys (and I'm certainly not going to tell them that).

    I've gone up the chain, and right now the roadblock is the people who have the power and the knowledge to help me are up for contract renewal at the end of the month (as am I) and will not ruffle any feathers until that is sorted out. I'm cautiously optimistic that once we get our new deals signed, they will go to bat for me
     
    O

    oikjn

    Ars Scholae Palatinae
    969
    Subscriptor++
  • #22
    just throwing this out there... you keep mentioning RDP for remote access, but also mention the computer is local to your house too... If that is the case, why not use the built-in windows "request remote assistance" instead? Pretty much the same exact thing as RDP except you need someone local on the machine to be able to initiate it. Since you have the computer there... that shouldn't be that big of a deal. I believe the "quick assist" app from MS in their app store can be even easier from that perspective and I believe it doesn't even need admin to install.
     
    H

    hal_incandenza

    Ars Centurion
    328
  • #23
    oikjn said:
    just throwing this out there... you keep mentioning RDP for remote access, but also mention the computer is local to your house too... If that is the case, why not use the built-in windows "request remote assistance" instead? Pretty much the same exact thing as RDP except you need someone local on the machine to be able to initiate it. Since you have the computer there... that shouldn't be that big of a deal. I believe the "quick assist" app from MS in their app store can be even easier from that perspective and I believe it doesn't even need admin to install.
    Click to expand...
    I am not familiar with this but will give it a try, thanks
     
    H

    hal_incandenza

    Ars Centurion
    328
  • #24
    torrancebott06 said:
    I understand your situation and your desire to continue using RDP to connect to your work laptop from your home network. However, IT professionals are often more conservative in their approach to security issues, and their main task is to protect corporate resources from possible threats. They may be concerned that enabling RDP might present a potential vulnerability to your work environment.

    To effectively argue your point of view and convince IT professionals, you should offer the following reasoning:

    Point out that you are not the only employee using RDP to remotely access a work laptop, and that many organizations provide similar capabilities to their employees.

    Point out that additional security measures, such as two-factor authentication or a virtual private network (VPN), can be applied between your home computer and work laptop to ensure a secure connection.

    Emphasize that you understand the security risks and are willing to take extra precautions by following your company's security policy and following the advice of IT professionals.
    Click to expand...
    This is the general approach I've taken, they've just been completely inflexible. Like I mentioned above, when our contract situations are sorted out my boss and I can both afford to be a little more aggressive. The organization only exists for the sake of the sports side, so up to a point we can strong arm them a bit
     
    owdi

    owdi

    Ars Praefectus
    3,972
  • #25
    I do this as well and feel your pain OP. I RDP from my personal computer with a nice monitor, kb, & mouse to my underpowered work laptop. The laptop, having only 16gb of ram, can barely run my work apps. I minimize the RDP session and use my main PC for anything that requires browsing the internet. It's much faster switching this way than a KVM.

    Nested RDP sessions work great as well. RDP to laptop, RDP to jump box over VPN, then RDP to server. Performance is great.

    To say RDP is insecure is laughable. It's used everywhere to access Windows servers, and there haven't been any significant vulnerabilities in Windows 10. Lock down access with firewall and require 2FA to log in.
     
    H

    hal_incandenza

    Ars Centurion
    328
  • #26
    owdi said:
    I do this as well and feel your pain OP. I RDP from my personal computer with a nice monitor, kb, & mouse to my underpowered work laptop. The laptop, having only 16gb of ram, can barely run my work apps. I minimize the RDP session and use my main PC for anything that requires browsing the internet. It's much faster switching this way than a KVM.

    Nested RDP sessions work great as well. RDP to laptop, RDP to jump box over VPN, then RDP to server. Performance is great.

    To say RDP is insecure is laughable. It's used everywhere to access Windows servers, and there haven't been any significant vulnerabilities in Windows 10. Lock down access with firewall and require 2FA to log in.
    Click to expand...
    While it's not as convenient and seamless as RDP, I did find a workable solution finally. I got a new Dell Ultrasharp with a KVM built in, and the Dell software allows you to assign a keyboard shortcut to switch between computers. So far it works pretty well, the only issues I've had is sometimes when the work laptop goes to sleep the monitor will turn off, even if I'm currently using my desktop, and Windows doesn't always maintain window sizes/location when switching. For now if I know I won't be working for a little while I just unplug the USB-C from the laptop.

    The one thing I'm missing is with my old setup I would sometimes run RDP on just one monitor, while playing music on the desktop on the 2nd monitor. Now everything switches over. Not a dealbreaker
     
    • Like
    Reactions: continuum and owdi
    LID919

    LID919

    Ars Centurion
    285
    Subscriptor
  • #27
    Two suggestions based on my experience working from home with both a work and personal device active.

    My current solution is to use a wireless keyboard and mouse which both have multiple radios. Each can switch between multiple devices with a quick button press. Both my work and personal devices have wireless USB dongles and the mouse and keyboard are paired with both. The monitor I need to unplug and plug in manually if I'm switching, but I normally don't need to use multiple monitors on both my personal and my work device at the same time, I plug the monitor into whichever device is getting more active use at the time. If you have multiple monitors, then plug them all into a single hub so you only have a single cable that needs switching. Or get fancier and just use a switch, keeping all devices plugged in at all times.

    Alternatively. Do you actually need remote desktop? Or do you just need access to the device? You might be able to just spin up the SSH service on the work device, Windows comes with an SSH client and server since 10. If you don't actually need to use any graphical programs on the work device, then just an SSH connection would be sufficient, rather than remote desktop.
     
    Arkannis

    Arkannis

    Ars Tribunus Militum
    1,977
    Subscriptor
  • #28
    Your new monitor may support picture in picture, or side by side, or both. Not sure if that would solve the audio problem (probably not) but might be worth looking at the manual to see if it's possible.

    Also, if you can get them to let you install PowerToys, you can used the Awake toy to keep your work computer awake permanently. I think that might be a winnable fight, since after all, it's your power that's being used, not the company's, and it would also mean they don't have to change the GPO's just for you (from what you've described, I doubt they'd know how to anyway.) They don't really have a good argument to not let you use it, it's currently maintained, and doesn't have any serious potential vulnerabilities.

    EDIT: FancyZones (another part of PowerToys) would probably help with the program windows moving around. Even if you don't want split up your screen, you could just set it to one big zone, and tell it to reopen windows in the zones they're assigned to.
     
    You must log in or register to reply here.
    Jump to latest Follow Reply
    Jump to latest Follow Reply