tag: Remote-Desktop · 4 items
- Engineer — Plan: If Windows endpoints use ‘Administrator protection’ and non-admin RDP access is broken, apply the remediation update Microsoft issued; verify affected build versions before scheduling the rollout.
- SOC/IR — Skip
- Leader — Skip
- Engineer — Plan: If deploying recent Windows updates on systems with ‘Administrator protection’ enabled, test RDP connectivity for non-admin users before broad rollout and check Microsoft’s guidance for a workaround or hotfix.
- SOC/IR — Skip
- Leader — Skip
- Engineer — Act: If you applied September Patch Tuesday updates and are seeing RDS failures, deploy the OOB fix immediately; check affected Windows versions against your estate and apply the emergency update to restore Remote Desktop Services, Hyper-V, and USB audio functionality.
- SOC/IR — Skip
- Leader — Skip
- Engineer — Act: Hold or roll back the September 2026 cumulative updates on Windows Server 2019/2022/2025 until Microsoft issues a fix; test any staged deployments in non-production before wider rollout to avoid RDS outages requiring hard resets.
- SOC/IR — Learn: RDS connectivity failures and unexpected hard-reset events seen in monitoring this week are likely patch-induced, not attack activity; useful triage context to avoid chasing false positives in endpoint or session logs.
- Leader — Plan: The September patch cycle has a confirmed defect disrupting RDS across three current Windows Server versions; confirm with engineering whether deployment is paused and whether any business-critical RDP-dependent workflows are at risk while the fix is pending.