Security For BYOD RDP?

Question

We would like users to be able remotely access their desktop PC from their personal laptops over a VPN connection, but we need them to have no access other than viewing the screen and remote controlling it.  No file transfer or drive redirection, no
printer redirection and no other way to transmit malware over the network if their personal laptop is infected.
Since these would be personal laptops we do not manage and are not joined to our domain, they would not recognize any group policies we apply. The restrictions would need to be enforced from their desktop PC, not their personal laptop.  They connect
directly to their desktop PC over VPN and then RDP.   There is no terminal server used.
Also is there any way to prevent copy and paste, drive redirection and printer redirection over RDP from a domain computer to non-domain computers, but allow it between two domain-joined computers?

Answer 1

On Mon, 3 Feb 2014 17:59:06 +0000, MyGposts wrote:
Would there be any risk to the Remote Desktop Gateway server or the internal network if someone used a malware-infected home PC to connect to the RDG server?
Potentially yes, but no more so than when connecting via a VPN.
Is there any way to prevent users from logging to RDS using only saved credentials that can be used by anyone if their home PC or laptop, iPad or Android tablet used for RDS connections is stolen?  
Most people have no encryption on their personal devices, so any laptop thief will be able to crack the Windows password with easily available Windows password reset tools and then log in and access the RDS site (likely bookmarked in IE) and then log into the
work network using the saved "remembered" credentials.
Out of the box RD Gateway in 2012 and 2012 R2 support smart card logon so
that would mitigate somewhat. It also supports pluggable authentication
methods so that you could potentially use other methods for 2FA or MFA.
The security risks in using an RD Gateway really aren't any greater than
using a VPN. What an RD Gateway allows you that I'm not sure can be
achieved with a VPN solution is one set of access policies for those
external to your network and a different set for those on your internal
network.
RDS specific questions would be better posted here:
http://social.technet.microsoft.com/Forums/windowsserver/en-US/home?forum=winserverTS
Paul Adare - FIM CM MVP
When in doubt, use brute force. -- Ken Thompson
I was looking for something that has a smaller security risk for malware transmission than RDP over VPN.  If it is only "not any greater," rather than actually "better and safer," then that seems like makes it a waste of time and
money for us to implement RD Gateway.  We could just let users connect with a VPN client directly to their desktop as they are used to doing.
It seems like it "should be" safer since it seems more difficult to transmit malware from an infected PC over a RDG connection than through VPN which may have other ports open plus users may be able to connect to network shares and mount drives
through the Remote Desktop MSTSC.exe application and that should not be available when using RD Gateway. 
Is there something else I'm missing that makes the risk of malware transmittal and data loss no lower when using a RD Gateway to reach a workstation from outside than when using VPN with a direct connection to reach a workstation?