ESET Server Security 11.1.12005.0 breaks RDP

[SIS Anton Tonev 0]

RDP is not possible (TCP port 3389 closed when trying from subnet & from private addresses) after upgrade from 11.0.12012.0 to 11.1.12005.0, even before restart of the server - that happened today with all out servers, doesn't matter whether their IP addresses are public or private.

Workaround is to change Advanced Setup => Network access protection => Network attack protection => Brute-force attack protection => Limit incoming RDP connections to :

from the default "Trusted zone" to "Private addresses" (applicable in our case).

Hope that helps until problem will be solved.

[Marcos 5,741]

So you have ESET Endpoint Antivirus but did not have the trusted networks configured. This will be fixed as of the next version, ie. "Limit RDP connections" will be set to "All networks" after upgrade. That said, the computer will be exposed at risk since RDP will be allowed also from untrusted networks. We strongly recommend configuring trusted networks properly and changing the above setting to "trusted networks" then. RDP is a common infection vector in ransomware attacks.