Remote desktop for working from home in a small firm: options, security and licensing

In many small firms and professional practices, working from home means remote desktop: from home you open the office computer, or a server, and work with the same programs and files as always. It is convenient and works well, but two things are often done wrong: how that desktop is reached from the internet, and which licences are needed. In this article we go through the options, how to protect them and what Microsoft says about licensing.

The usual ways to set it up

1. Remote desktop inside a VPN

The person first connects the VPN from their laptop and, once inside the office network, opens the remote desktop of their computer or the server. From the internet only the VPN door is visible; remote desktop cannot be reached from outside. It is the simplest option for a few people and the one we usually set up with WireGuard. How we manage it is in managed VPN with WireGuard or OpenVPN; if the team is spread across several places, a private network with NetBird or Tailscale does the same job.

2. Remote Desktop Gateway (RD Gateway)

This is a Windows Server role that receives connections over HTTPS (port 443) and passes them on to the computers or servers inside. There is no need to install a VPN on every laptop. Two-factor authentication is not built into the gateway: it needs an additional component. Licensing depends on how it is set up, and we review it with you. It makes sense when there is a Windows server in the office and quite a few people connecting.

3. In the browser: Remote Desktop web client or Apache Guacamole

The person opens a web page, signs in and works on the office desktop inside the browser, without installing anything on their computer. There are two common ways to set this up. Microsoft’s Remote Desktop web client is part of a Remote Desktop Services (RDS) deployment on Windows Server, with an RD Gateway and RD Web Access, and is designed for desktop servers. Apache Guacamole is an open source gateway (Apache License 2.0) installed on a Linux server that connects over RDP, VNC or SSH to each person’s PC as well as to a server.

• Pros: no VPN and no remote desktop program to install: a browser is enough, including on a home computer or a tablet. Remote desktop is not exposed, because from the internet only an HTTPS page is visible, and two-factor authentication or the company sign-in (Microsoft, Google or Keycloak) sits in front. With Guacamole you can also record sessions and keep a log of who reached which computer.
• Cons: the sign-in page is published on the internet, so it has to be kept up to date and monitored, and it is one more piece to look after. Some things work worse than with the Remote Desktop program: printing, working with several screens, or using a card reader or a smart card certificate inside the remote desktop, which matters if you sign with AutoFirma or in LexNET with a card.
• Licensing: going through the browser does not change licensing. If several people work on a Windows server, you still need Windows Server and Remote Desktop access licences (RDS CALs), whether they come in through Guacamole or through Microsoft’s web client, which also requires those licences to be per user.

4. What not to do: port 3389 open

Forwarding the remote desktop port (3389) on the router to a computer or server is the quickest option, and also the most dangerous. Bots scan the internet looking for that port and try passwords non-stop, and every so often vulnerabilities appear that let attackers in without one. Bodies such as Spain’s INCIBE advise against exposing it and recommend protecting it with a VPN. Moving it to another port number does not fix this: it only hides it a little.

Security: the minimum

• One user per person, never a shared account. That way you know who has logged in and can remove one person without affecting the others.
• Two-factor authentication on the VPN or the gateway (on an RD Gateway, through an additional component): an app on the phone or a hardware key.
• Network Level Authentication (NLA) enabled on remote desktop, so credentials are requested before the session opens.
• Lockout after several failed attempts and a log of connections: who logs in, when and from where.
• Up-to-date computers and servers, especially the one acting as the front door.
• Same-day leavers: when someone leaves the company, their VPN or gateway access is cut straight away.
• Backups of the computers and servers people connect to, kept off site and tested.

Licensing: what you need in each case

This is where most doubts arise, and where it is easiest to be non-compliant without knowing it. We summarise what Microsoft’s documentation says; for a specific case, confirm it with your licensing provider.

Each person connects to their own office PC

If each person uses remote desktop to reach the computer at their desk, and that computer runs Windows Pro (or Enterprise), no extra licence is needed: the Pro edition already includes remote desktop as a host. The Home edition does not: with Windows Home you can only connect to other computers, not receive connections. Office stays on whatever licence that person already has. This applies when people come in through a VPN; if they come in through an RD Gateway, which is a Windows server, licensing depends on how it is set up and we review it with you.

Several people work on a server

If several people work at the same time on a Windows server with the programs installed (Remote Desktop Services, RDS), you need:

• Windows Server client access licences (CALs), per user or per device.
• Remote Desktop Services client access licences (RDS CALs), also per user or per device, and the Remote Desktop licensing server set up.
• Office with shared computer activation. With Microsoft 365, shared computer activation is only available in plans that include Microsoft 365 Apps for enterprise (such as E3 or E5) and, among business plans, in Microsoft 365 Business Premium. Business Standard does not include it.

The two Windows Server administration sessions

Windows Server allows two remote desktop sessions without RDS licences, but they are for administering the server, not for people to work on it. Using them so that two people work on the accounting software every day is not covered by that exception: in that case you need the licences in the previous section.

Office PC or server?

For a few people who already have their computer in the office, connecting to their own PC through a VPN is the simplest option and has no licensing cost. A desktop server pays off when there are more people, when you do not want a computer left on in the office for each of them, or when a management program works better installed in one place. We decide it with you based on how many people you are, which programs you use and which licences you already have.

In IT support for small firms we set up remote desktop and the VPN, with one user per person and two-factor authentication, and we spell out the licences in the quote. If you want us to review how you have it set up now, call or write to us.

Frequently asked questions

Is changing port 3389 to another one enough?

No. Changing the port cuts the noise from the simplest bots, but remote desktop is still exposed to the internet and to its vulnerabilities. What protects it is not exposing it: VPN or gateway, with two-factor authentication.

Can a remote control program replace remote desktop?

It can work for occasional support, but for daily work it has the same problems if misused: shared passwords, unlogged access and computers left reachable from outside. If you use one, set it up with one user per person, two-factor authentication and logged access.

Can I use Office on a desktop server with Microsoft 365 Business Standard?

According to Microsoft’s documentation, no: Business Standard does not include shared computer activation. Among business plans, only Business Premium includes it; plans with Microsoft 365 Apps for enterprise include it too.

References

• Microsoft Learn: Remote Desktop Services client access licences (CALs).
• Microsoft Learn: overview of shared computer activation for Microsoft 365 Apps, with the plans that include it.
• INCIBE: recommendations for protecting remote desktop (in Spanish).
• Microsoft Learn: Remote Desktop web client requirements, with RD Gateway and per-user licences.
• Apache Guacamole: official manual.