RDP 未能通过 PCI-DSS 扫描

Question

由于设置 RDP 时 Microsoft Server (2012 R2) 生成的默认自签名证书，我遇到了 RDP 未能通过 PCI-DSS 扫描（端口 3389）的问题。我需要配置 RDP 以使用受信任的证书。我该怎么做？我找不到任何东西可以解释这是如何完成的。

R/ 普雷斯科特..

Answer 1

非常感谢 Ait.Com 的支持人员为我解决了这个问题。以下步骤特定于 Windows Server 2012 r2，不能说它适用于任何其他版本。

Right click on Windows icon on bottom left and select Run
Enter "gpedit.msc" & hit Enter or click OK
You will see the Group Policy Editor window, on left pane select:
Computer Configuration ->
Administrative Template ->
Windows Components ->
Remote Desktop Services ->
Remote Desktop Session Host ->
Security
Under Security we will change the following settings:
Server authentication certificate template: Select Enabled
inside the input box, enter TLS 1.2 click Apply and OK to close the window
Set client connection encryption level: Select Enabled and on Encryption level dropdown select High Level
Require use of specific security layer for remote (RDP) connections: Select Enabled and on Security layer dropdown select SSL
Require user authentication for remote connections by using Network Level Authentication: Select Enabled
Install the verified TLS 1.2 certificate you bought from a certificate authority:
Right click on Windows icon on bottom left and select Run
Enter MMC & hit Enter or Click OK, a Console1 window will appear
On File menu select Add/Remove snap-in...
Select Certificates on left pane & click the Add button at the center
Select Computer Account & click Next
Select Local Computer & click finish
On left pane select Certificates (Local Computer) -> Personal
Inside Personal folder, you may or may not find a Certificates subfolder, but its ok in either case
If not already, we will import the TLS 1.2 certificate here inside Personal folder Right click -> All Tasks -> Import
By default, Local Machine is selected, click Next
Browse the file path and select the file here, click Next
Enter Password for the certificate & click Next
Select Place All certificates in the following Store, Click Browse to Select Personal folder, we can also select Remote Desktop folder here but only one is required...
Click Next and Click Finish
You should see your certificate inside Personal -> Certificates or Remote Desktop -> Certificate folder (whichever you selected)
Run these commands in power-shell (replace #YourHash# with your Thumbprint from the notepad). run these commands in each line one after the other. PowerShell should show a message that all went successful
$TSGeneralSetting = Get-WmiObject -class "Win32_TSGeneralSetting" -Namespace root\cimv2\terminalservices -Filter "TerminalName='RDP-tcp'" 
$Hash = "#YourHash#"
$TSGeneralSetting.SSLCertificateSHA1Hash = $Hash
$TSGeneralSetting.put()