🎯

Aim / Objective

To demonstrate remote administration using Remote Desktop Protocol (RDP / TCP port 3389) between two networked computers, configure Network Level Authentication (NLA), explore cross-platform alternatives (VNC, AnyDesk, SSH with X11 forwarding), and evaluate security, clipboard/drive sharing risks, and session encryption.

🧰

Hardware & Software Requirements

Hardware Components

✓ Two desktop computers (PC-Host and PC-Client) connected to the same LAN / switch
✓ Display monitors, keyboards, and mice on both systems

Software, OS & Tools

✓ Windows 10/11 Pro or Enterprise edition on Host (RDP Server is not supported on Windows Home edition)
✓ Remote Desktop Connection client (`mstsc.exe`) on Client PC
✓ Alternative Remote Software: AnyDesk / TeamViewer / RustDesk or VNC (RealVNC / TightVNC)
✓ SSH Client (OpenSSH / PuTTY)

👨‍🏫

Teacher's Lab Delivery Guide

Essential briefing notes, pedagogy, and setup tips for lab instructors

Faculty Exclusive

⏱ 5-Minute Pre-Lab Lecture Briefing:

Explain that RDP does NOT stream video like YouTube; it transmits graphical drawing commands (GDI/DirectX primitives, fonts, button renders) and user inputs (keystrokes, mouse coordinates), making it bandwidth efficient. Point out that Windows Home edition can act as an RDP Client, but only Windows Pro/Enterprise can act as an RDP Server.

📝 Key Concepts to Write on Whiteboard:

RDP architecture: Client-Server model over TCP Port 3389
Network Level Authentication (NLA) requiring credential verification prior to TLS handshake
Enabling Remote Desktop in Windows Settings and Windows Defender Firewall rules
Resource redirection: Clipboard, Local Drives, Printers, Audio, Smart Cards
Data Security risks: Man-in-the-Middle (MitM), credential theft, clipboard exposure, brute-force attacks
Comparative evaluation: RDP vs VNC (RFB protocol) vs AnyDesk/TeamViewer (cloud-brokered WebRTC/custom) vs SSH (terminal/X11)

⚙ Pre-Class Lab Setup:

Pair students in twos: Student 1 acts as Remote Host (Target), Student 2 acts as Client. Verify that both systems have local accounts with strong passwords, as Windows rejects blank-password RDP logins by default.

⚠ Common Student Pitfalls & Fixes:

Students forget that Windows RDP rejects accounts without passwords. Ensure students set a password on the target user account before attempting connection.

🛡 Lab Safety & ESD Precautions:

Never expose Port 3389 directly to the public internet without a VPN or Zero-Trust tunnel—scanners brute-force RDP ports within minutes.

📜

Step-by-Step Practical Procedure

1

Enable Remote Desktop on Host System (Server)

On the Host PC, go to Settings -> System -> Remote Desktop. Toggle "Remote Desktop" to ON. Expand the settings and ensure "Require computers to use Network Level Authentication (NLA) to connect" is checked. Note the Host PC IP address (`ipconfig`).

Command / Action:

Settings -> System -> Remote Desktop -> Enable Remote Desktop: ON

💡

Teacher Note / Pro-Tip: NLA prevents unauthenticated clients from consuming server resources or attempting Denial-of-Service attacks.

2

Configure Local User Permissions & Windows Firewall

Click "Select users that can remotely access this PC" and ensure the target local user belongs to the "Remote Desktop Users" or "Administrators" group. Verify that Windows Firewall allows "Remote Desktop (TCP-In 3389)".

Command / Action:

net localgroup "Remote Desktop Users" [Username] /add

💡

Teacher Note / Pro-Tip: Standard non-admin users must be explicitly added to the Remote Desktop Users group.

3

Initiate Connection from Client PC via MSTSC

On the Client PC, press `Win + R`, type `mstsc` and hit Enter. Enter the Host PC IP address (e.g. `192.168.1.15`). Click "Show Options" -> "Local Resources" tab. Examine drive redirection, clipboard sharing, and audio settings. Click "Connect".

Command / Action:

Run: mstsc /v:192.168.1.15

💡

Teacher Note / Pro-Tip: Disabling Drive and Clipboard redirection prevents malware or sensitive files from leaking between sessions.

4

Authenticate and Inspect Remote Session

Accept the self-signed SSL/TLS certificate warning after verifying the certificate thumbprint. Enter the Host PC username and password. The Host PC will lock its physical screen and the remote desktop will appear in a window on the Client PC.

Command / Action:

Credential: Target_Username & Password

💡

Teacher Note / Pro-Tip: Notice the connection quality bar at the top displaying 128-bit/256-bit TLS encryption status.

5

Compare with Alternative Remote Desktop Solutions

Demonstrate AnyDesk / TeamViewer / RustDesk and compare with RDP: notice that cloud-brokered tools work across NAT and firewalls without port forwarding, whereas pure RDP requires LAN visibility or port forwarding / VPN.

Command / Action:

Test: RustDesk / AnyDesk 9-digit code connection

💡

Teacher Note / Pro-Tip: VNC transmits raw pixel bitmaps (higher bandwidth), while RDP transmits vectorized drawing primitives (lower bandwidth).

⚡

Interactive Hands-On Lab Simulator

Practice and test concepts virtually before or after performing on physical lab equipment

Live Interactive

Loading simulator...

📊

Observations & Student Lab Record

Students are required to record the following measured parameters, hardware specifications, and output status into their physical lab journals:

Remote Technology	Default Port / Protocol	Encryption Method	NAT Traversal Capability	Bandwidth Efficiency
Microsoft RDP	TCP 3389 (UDP optional)	TLS 1.2 / 1.3 with NLA	Requires VPN or Port Forwarding	High (Vector primitives & font caching)
VNC (Virtual Network Computing)	TCP 5900 (RFB protocol)	None / SSH Tunnel / TLS (in Enterprise)	Requires Port Forwarding	Low (Raw or compressed pixel bitmaps)
AnyDesk / TeamViewer	TCP 443 / 80 / 6568	RSA-2048 & AES-256 GCM	Built-in (Cloud relay & NAT hole punching)	High (Custom video codec DeskRT)
SSH (Secure Shell)	TCP 22	SSH-2 (ChaCha20 / AES-CTR)	Requires Port Forwarding	Ultra-High (Pure CLI or compressed X11)

💡

Conclusions & Learning Outcome

Microsoft Remote Desktop Protocol (RDP) was successfully configured and demonstrated over a local area network. The security mechanisms—including Network Level Authentication (NLA), TLS encryption, and clipboard/drive redirection policies—were analyzed. Comparison with alternative remote access solutions highlighted trade-offs between ease of NAT traversal and corporate security control.

❓

Oral Exam & Viva Questions with Answers

Essential questions asked by external examiners and lab evaluators (Accordion UI)

Answer:

TCP port 3389 (modern versions can also use UDP 3389 for enhanced audio/video streaming).