Remote Access Protection (RAP) is a security layer that monitors and controls RDP access to Heimdal-protected endpoints. It blocks unauthorized RDP connection attempts by default and gives you granular control through allowlisting and Group Policy settings.
1. Description
2. How does Remote Access Protection (RAP) work?
3. Remote Access Protection view
4. Remote Access Protection settings
5. Available actions
DESCRIPTION
The Remote Access Protection (RAP) submodule provides full visibility and control over RDP connection attempts to devices protected by the Heimdal Agent.
When RAP is enabled in the Group Policy (Endpoint Settings → select a Windows GP → Endpoint Detection → Firewall & RAP → RAP):
- All inbound RDP traffic is monitored.
- Connections are blocked by default, unless the source IP is allowlisted or belongs to a private IP range permitted through the "Do not block private IPs" setting from the GP.
Each RDP attempt is logged in the Dashboard, allowing administrators to:
- Review the connection source and target.
- Allowlist trusted IPs.
- Set expiration dates for the allowlist entries.
- Acknowledge connection attempts (marking them as Blocked).
HOW DOES REMOTE ACCESS PROTECTION (RAP) WORK?
RAP monitors incoming Remote Desktop Protocol (RDP) traffic and blocks any connection that is not explicitly allowlisted, preventing unauthorized access by default.
REMOTE ACCESS PROTECTION view
All detected RDP connection attempts are displayed in two places:
- The product view, from the Heimdal Dashboard (Products -> Endpoint Detection -> Firewall -> Remote Access Protection):
- The client specifics view, opened by clicking a hostname in the Remote Access Protection grid:
Both views contain the following columns:
- Hostname - name of the targeted machine.
- Last Known Username - the most recent user logged in to the machine.
- IP - the source IP attempting the RDP connection.
- Expected User - the last user connected from the source IP, retrieved from Login Anomaly Detection (LAD). If a match is found, the expected username is displayed; if no match is found, or LAD is not licensed or configured, the field shows N/A.
- MFA Enabled - displays an Enabled or Disabled status icon, based on the current MFA configuration of the user identified in the Expected User column. Available only if M365 User Security and Login Anomaly Detection (LAD) settings are active; if M365 User Security is not licensed or enabled, the field displays N/A.
- Strong Password enabled - displays an Enabled or Disabled status icon, based on the current strong-password configuration of the user identified in the Expected User column. Available only if M365 User Security and Login Anomaly Detection (LAD) settings are active; if M365 User Security is not licensed or enabled, the field displays N/A.
-
State - reflects the status of each recorded RDP connection:
- Default blocked, not actioned (default state) - the connection was automatically blocked by RAP and has not yet been reviewed by an administrator.
- Blocked - manually acknowledged by an administrator, or auto-updated after 7–30 days if the greylist auto-acknowledge Group Policy option is enabled.
- Allowlisted - the connection was permitted based on the corresponding Group Policy Allowlist entry, as long as the entry has not expired.
- Risk Score - displays the risk score of the user identified in the Expected User column; if M365 User Security is not licensed or enabled, the value displayed is 0.
- Timestamp - when the connection attempt occurred.
AVAILABLE ACTIONS
After selecting one or multiple entries from the RAP product or client specifics views, the following actions can be taken from the Select what action to take dropdown, depending on the state:
For Default blocked, not actioned entries:
- Acknowledge - changes the state to Blocked.
-
Add to Allowlist - the modal allows single or multi-GP selection, and an expiration date can be configured. If M365 validation is enabled and the risk score exceeds the threshold, an additional confirmation dialog is shown.
For Blocked entries:
-
Add to Allowlist - the modal allows single or multi-GP selection, and an expiration date can be configured. If M365 validation is enabled and the risk score exceeds the threshold, an additional confirmation dialog is shown.
For Allowlisted entries:
-
Remove from Allowlist - available only when the allowlist entry is an exact match with the listed IP address. The modal allows single or multi-GP selection. Removal is not supported for IPs that are part of a defined IP range in the Group Policy Allowlist.
The Allowlist action can be performed on a single GP selection, which displays the following validation modal:
or on a multiple-GP selection, as shown below:
REMOTE ACCESS PROTECTION settings
Note: Remote Access Protection can be enabled only if the Firewall module is also active.
General Settings
- RAP-monitored ports - the port(s) monitored for incoming RDP connections. Accepts single or multiple port values within the range 1–65535, separated by commas (e.g., 3389,3390). Editing the ports in either the Brute Force Attack Protection or the Remote Access Protection section automatically synchronizes the values to maintain consistency across both modules.
- Don't block private IP addresses - allows all incoming RDP connections from private IPs.
-
M365 User Security integration - enables the integration with M365 User Security so that RAP can evaluate the risk score of the user associated with an incoming RDP connection. When enabled, the following sub-option becomes available:
-
Extra validation on allowlist when user risk score is higher than [value] - requires an additional confirmation step before allowlisting an IP when the associated user's risk score exceeds the configured value. This sub-option is available only when M365 User Security integration is enabled and Login Anomaly Detection (LAD) is configured.
-
Extra validation on allowlist when user risk score is higher than [value] - requires an additional confirmation step before allowlisting an IP when the associated user's risk score exceeds the configured value. This sub-option is available only when M365 User Security integration is enabled and Login Anomaly Detection (LAD) is configured.
-
Automatically acknowledge greylist detection blocking after [N] days - entries in the Default blocked, not actioned state are automatically changed to Blocked once the configured number of days (7–30) has passed since their recorded Timestamp, unless acknowledged manually before then. This streamlines reporting by finalizing the detection state without requiring manual administrative review. The day-count field is editable only when this option is enabled.
Allowlist
The Allowlist authorizes IT administrators to manually specify IPv4 addresses or IPv4 ranges that are permitted to connect via RDP:
- Entries can be added manually or in bulk using the Import functionality (a sample CSV template is available from the tooltip next to the section title).
- IP ranges can be added using the hyphen (-) notation (e.g., 192.168.0.1-192.168.0.255).
- Entries can be searched and are listed in a grid with the Value, Expiration date, and Action columns.
Each allowlist entry can have an optional expiration date:
- If no expiration date is set, the entry remains valid until manually removed.
- If an expiration date is configured, the entry remains valid until it expires, but remains visible in the product grid after expiration for traceability.
- When setting or editing an expiration date, the system enforces that the selected date is after the current date, so expired or same-day entries cannot be configured.
- Allowlist entries can be edited or deleted as needed.
IMPORTANT
The Remote Access Protection (RAP) submodule relies on Windows Firewall and inherits its limitations (e.g., ~500 entries per rule).