Zero Trust RDP & Secure Remote Access Glossary

Azure Virtual Desktop is Microsoft's cloud service for delivering virtual desktops and published applications from Azure. It supports multi-session Windows 11 and Windows 10, integrates with Microsoft Entra ID, and is billed through Azure consumption. Organizations evaluate it alongside RDS, third-party DaaS platforms, and approaches that modernize existing infrastructure. Compare Azure Virtual Desktop alternatives →

A bastion host is a hardened system that provides a controlled entry point to resources on a private network, often for administrative RDP or SSH access. It can reduce the number of directly exposed internal systems, but the bastion becomes a high-value access point and therefore requires strict access controls, patching, monitoring, and redundancy where needed. Learn More →

Citrix provides application and desktop virtualization through Citrix Virtual Apps and Desktops and Citrix DaaS. Depending on the deployment model, the architecture can include Citrix Workspace, StoreFront, Delivery Controllers, Virtual Delivery Agents, and Citrix Gateway. These components broker, secure, and deliver centralized applications and desktops to authorized users. Compare Citrix alternatives →

CredSSP (Credential Security Support Provider) is a Windows authentication protocol that securely delegates a user's credentials from a client to a remote server, most visibly during Remote Desktop logons that use Network Level Authentication. Because delegated credentials are sensitive, CredSSP versions and patch levels matter; a 2018 vulnerability (CVE-2018-0886) made mismatched updates a common connection failure. Learn More →

Desktop as a Service is a cloud delivery model in which a provider hosts and manages virtual desktop infrastructure and delivers desktops to users on a subscription basis. The provider operates the platform, capacity, and availability, while the customer manages images, applications, and users to a degree that varies by offering. Learn More →

Desktop virtualization separates a desktop operating system and its applications from the physical device used to access them. The desktop runs centrally, on servers, in a data center, or in the cloud, and gets presented to the user over a remoting protocol. VDI, RDS session-based computing, and DaaS are all forms of desktop virtualization. Learn More →

Firewall exposure is the attack surface created when inbound ports are opened through a firewall so external traffic can reach internal services. Every open inbound port, TCP 3389 for RDP being the obvious example, is a discoverable, attackable entry point. Architectures based on outbound-only connections avoid this entirely by initiating sessions from inside the network instead. Why open firewall ports are a risk →

An identity provider is the system that authenticates users and issues identity assertions that other applications trust, commonly via SAML or OpenID Connect. Microsoft Entra ID and Okta are widespread examples. In Zero Trust designs, the IdP is the authoritative decision point for who a user is, and access policies build on its verdicts.

Least privilege access is the security principle that every user, session, and system receives only the minimum permissions required for its task, and only for as long as needed. Applied to remote access, it limits which desktops a user can reach and what they can do there, reducing the impact of compromised credentials. Learn More →

Multi-factor authentication requires a user to prove identity with two or more independent factors: typically something known (a password), something possessed (a device or token), and something inherent (a biometric). Strong MFA substantially reduces the risk from stolen passwords, although phishing, session theft, MFA fatigue, and other attacks can still bypass or undermine some MFA implementations. It remains foundational for remote desktop security. Learn More →

MSP remote access is the controlled access managed service providers use to administer systems across multiple customer environments. Effective implementations separate tenants, enforce per-client permissions and MFA, maintain auditability, and minimize shared credentials or standing network-level access between the MSP and customer networks. Explore remote access for MSPs →

Multi-tenancy is an architecture where one platform serves multiple customer organizations, or tenants, while keeping each tenant's users, data, and configuration isolated from the others. For MSPs, genuine multi-tenancy means administering many client environments from one console, with no shared credentials and no cross-tenant visibility. Explore multi-tenant remote access for MSPs →

Multi-tenant remote access applies multi-tenancy to remote desktop connectivity: a provider manages remote access for many customer organizations through one platform, with per-tenant user directories, policies, and audit trails. It removes the need for separate VPNs or shared administrative credentials for each customer environment. See the Multi-Tenancy entry ↑

Network Level Authentication is an RDP security feature that requires users to authenticate before a full remote desktop session is established. By completing authentication first, using CredSSP, NLA keeps unauthenticated connections from consuming session resources and shields the Windows logon screen from direct exposure. It is enabled by default on supported Windows versions. Learn More →

Omnissa Horizon is the desktop and application virtualization platform formerly known as VMware Horizon, spun off under Omnissa in 2024. It delivers virtual desktops and published apps from on-premises or cloud infrastructure using the Blast Extreme and PCoIP protocols, with Unified Access Gateway providing external connectivity. Compare Omnissa Horizon alternatives →

Parallels RAS (Remote Application Server) is a virtual application and desktop delivery platform that publishes Windows applications and desktops from RDS session hosts, VDI, or cloud infrastructure through a single console. It is positioned as a simpler, license-inclusive alternative to larger virtualization suites. Compare Parallels RAS alternatives →

RD Connection Broker is the Remote Desktop Services role that routes each incoming user to the correct destination, whether that is an available session host, a pooled virtual desktop, or an existing disconnected session. It provides load distribution across an RDS farm and session reconnection, and it stores the deployment's configuration in its database. Read the complete Connection Broker guide →

RD Gateway is a Windows Server role that carries RDP connections through HTTPS, typically over TCP 443, with UDP 3391 available for RDP over UDP. It lets remote users reach internal desktops without directly exposing each host's RDP listener, while the gateway itself remains an internet-facing system requiring hardening, patching, and monitoring. Read the complete RD Gateway guide →

RD Web Access is the Remote Desktop Services role that presents published desktops and RemoteApp programs to users through a browser portal or the Workspaces feed. It handles discovery and launch, not the session itself: connections started from the portal still travel over RDP, usually through RD Gateway. Read the complete RD Web Access guide →

RDP is Microsoft's protocol for interacting with a remote Windows computer as if sitting in front of it: screen output travels to the user while keyboard and mouse input travel back. It underpins Remote Desktop connections and Remote Desktop Services, using TCP and UDP port 3389 by default. Learn More →

RDP encryption protects remote desktop traffic in transit. Modern RDP negotiates TLS and, with Network Level Authentication, authenticates users before session setup; legacy "RDP Security Layer" encryption is deprecated. Encryption alone does not address stolen credentials, exposed listeners, or over-broad authorization. Those need identity and access controls instead. How RDP encryption works →

An RDP file (.rdp) is a plain-text configuration file that stores connection settings for a Remote Desktop session, including the target computer, display options, and redirection preferences. Opening the file launches the Remote Desktop client with those settings applied. Because it is editable text, its contents can be inspected or centrally managed.

RDP over VPN is a remote-access model in which a user first connects to a private network through a VPN and then starts an RDP session to an internal system. It can shield RDP from direct internet exposure, but security and performance depend on VPN configuration, credential protection, segmentation, and the scope of network access granted. Compare RDP over VPN approaches →

Port 3389 is the default TCP and UDP port used by Microsoft Remote Desktop Protocol. Direct internet exposure can attract automated scanning, password attacks, and ransomware activity. Security guidance recommends restricting access rather than relying on a changed port alone; alternatives include RD Gateway, segmented VPN access, ZTNA, or outbound-brokered remote access. Learn More →

RDP security is the set of controls that protect Remote Desktop Protocol access against credential attacks, exposure, and session compromise. Core measures include multi-factor authentication, Network Level Authentication, TLS encryption, eliminating direct internet exposure of port 3389, least-privilege authorization, and monitoring. No single control is sufficient on its own. Learn More →

An RDP session is the authenticated connection between a user and a remote Windows machine, encompassing the user's desktop state, running applications, and input/output streams. Sessions can be active, disconnected (running without a connected client), or logged off. Session limits, timeouts, and monitoring are managed through Windows policy and RDS tooling. See how RDP sessions work →

Remote Desktop Services is the Windows Server platform for session-based desktops and published applications, where multiple users share server-hosted sessions delivered over RDP. Its roles include RD Session Host, Connection Broker, Gateway, Web Access, and Licensing. It is unrelated to Amazon RDS, a cloud database service. Learn More →

An RDS CAL (Client Access License) is the Microsoft license each user or device needs to connect to Remote Desktop Services, purchased in addition to Windows Server licensing. User CALs follow named people across devices; Device CALs follow shared machines. CALs are issued and tracked by an RD Licensing server. Learn More →

An RDS farm is a group of RD Session Host servers that publish the same desktops or applications and share user load. The RD Connection Broker distributes incoming connections across the farm and reconnects users to existing sessions, providing scale and resilience beyond what a single session host offers. See RDS farms explained →

Remote desktop latency is the delay between a user's input and the visible response in a remote session. It is driven by network round-trip time, packet loss, protocol transport (TCP vs UDP), encoding, and server load. High latency makes sessions feel sluggish; sustained spikes usually indicate a path or capacity problem. Learn More →

A reverse proxy for RDP is an intermediary that accepts remote desktop connections on behalf of internal hosts, so individual machines never expose RDP listeners directly. RD Gateway is the Microsoft implementation of this pattern. Brokered, outbound-connection architectures achieve the same goal without any internet-facing listener at all. See how SecureRDP eliminates inbound listeners →

RMM is the software category MSPs use to monitor, patch, script, and remotely control client endpoints at scale. RMM platforms typically bundle a remote-control tool for technicians; organizations often pair or replace that component with dedicated secure remote access when end users, auditability, or Zero Trust requirements are involved. Compare console-based remote access approaches →

Secure RDP refers to the practice of protecting Remote Desktop Protocol sessions against interception, credential attacks, and unauthorized access. Common controls include multi-factor authentication, Network Level Authentication, TLS encryption, restricted or brokered connectivity instead of an open port 3389, and monitoring of session activity. No single control is sufficient on its own. Explore the SecureRDP platform →

Secure remote access is the discipline of letting users reach internal desktops, applications, and systems from outside the network without exposing those resources to attack. It combines identity verification (MFA), least-privilege authorization, encrypted transport, and architectures that avoid open inbound ports or broad network-level connectivity. Learn More →

TSplus (originally Terminal Service Plus) is a remote access and application publishing product for Windows that presents desktops and apps through RDP-based sessions and an HTML5 web portal. It is positioned as a lower-cost alternative to Citrix and RDS-based deployments for small and mid-sized environments.

Virtual Desktop Infrastructure hosts full desktop operating systems as virtual machines on centralized servers, giving each user a dedicated (persistent) or pooled (non-persistent) desktop delivered over a remoting protocol. VDI differs from RDS session-based computing, where users share one server OS, and from DaaS, where a provider operates the platform. Learn More →

Zero Trust is a security model that removes implicit trust based on network location: every access request is authenticated, authorized, and continuously evaluated using identity, device, and context. "Never trust, always verify" replaces the perimeter assumption that inside equals safe. NIST SP 800-207 defines its reference architecture. Learn More →

Zero Trust Architecture is the structural implementation of Zero Trust described in NIST SP 800-207: a policy engine and policy administrator decide access, policy enforcement points sit in front of resources, and signals about identity, device health, and context feed every decision. It is the blueprint; Zero Trust is the model. Learn More →

Zero Trust RDP applies Zero Trust principles to remote desktop access by authenticating and authorizing each session based on user, device, and policy context rather than network location alone. Implementations commonly use MFA, least-privilege access, and brokered connectivity to avoid direct internet exposure of RDP services and reduce reliance on VPN-based network access. Learn More →

Zero Trust Network Access is a technology category that grants users access to specific applications and resources, never the whole network, based on identity, device posture, and policy. Connections are brokered per session, protected applications stay off direct public exposure entirely, and ZTNA has become the leading replacement pattern for remote-access VPNs. Learn More →