Objective
To provide a Windows Worklet that disables Remote Desktop Services (RDP) by updating the system registry, serving as a mitigating control against vulnerabilities like BlueKeep (CVE-2019-0708) or general endpoint security hardening.
Overview
Remote Desktop Protocol (RDP) provides remote administrative access to Windows systems, but if left exposed or unpatched, it presents a significant attack vector.
This Worklet checks whether RDP connections are disabled via the fDenyTSConnections registry key (HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server). If RDP is enabled (0), the remediation script automatically updates the key to 1 to block incoming RDP connections.
Worklet Setup Instructions
1.Navigate to Policy Creation:
Log in to the Automox console, go to Policies, and click Create Policy.
2.Select Windows Worklet Tile:
In the policy creation wizard, select the Worklet policy type and choose the Windows tile.
3.Configure Policy Details:
Enter a descriptive name for your Worklet (e.g., Hardening - Disable Remote Desktop Services).
4.Add Evaluation and Remediation Scripts:
Copy and paste the provided PowerShell scripts into the respective Evaluation Code and Remediation Code blocks in the console.
5.Assign Groups and Schedule:
Associate the Worklet with your target Device Group(s), configure your preferred execution schedule, and click Create Policy.
Worklet Code Snippets
Evaluation Code
PowerShell
# Define Registry Key and sub-value to evaluate
#############################################
$regPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server"
$regProperty = "fDenyTSConnections"
$desiredValue = '1'
#############################################
# Retrieve current value for comparison
$currentValue = (Get-ItemProperty -Path $regPath -Name $regProperty -ErrorAction SilentlyContinue).$regProperty
# Compare current with desired and exit accordingly
# 0 = Compliant (RDP Disabled), 1 = Non-Compliant (RDP Enabled / Flag for Remediation)
if ($currentValue -eq $desiredValue) {
Exit 0
} else {
Exit 1
}
Remediation Code
PowerShell
# Define Registry Key and sub-value to modify
#############################################
$regPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server"
$regProperty = "fDenyTSConnections"
$desiredValue = '1'
#############################################
try {
Set-ItemProperty -Path $regPath -Name $regProperty -Value $desiredValue -ErrorAction Stop
Write-Output "Successfully disabled Remote Desktop Services (fDenyTSConnections set to 1)."
Exit 0
} catch {
Write-Error "Unable to update $regProperty: $_"
Exit 1
}
Key Considerations
Active RDP Sessions: Disabling RDP will block new incoming connections, but existing active RDP sessions may remain connected until terminated or rebooted.
Management Scenarios: If remote access is required for administrative maintenance, ensure alternative remote management tools (such as Automox Remote Control or PowerShell Remoting) are active prior to running this policy.