Use Case 10

Who Is This Use Case For?

This use case is for security-conscious organizations working to mitigate bad actors intent on stealing remote desktop protocol (RDP) credentials for privilege escalation or lateral infrastructure attacks.

The Problem

Microsoft Remote Credential Guard (RCG), the traditional RDP in-memory credential protection solution, has limitations that do not work for all organizations. In addition, RCG limits the types of credentials available for use, as well as in some traditional IT tasks, such as account delegation or use of service accounts in automation.

The Solution

How does an organization protect RDP in-memory credentials while maintaining flexibility? Providing a unique solution, Privileged Access Management transparently rotates credentials on every check-out for an RDP session, thereby mitigating future exploitation of the RDP credentials. Furthermore, credentials need not be passed to employees as each authentication effectively occurs one time, thereby removing the need for rotating credentials upon offboarding.

How It Works

1. Enable Devolutions Server’s Privileged Access Management from the Devolutions Server web interface.
2. Set up providers and import accounts to manage.
3. Add entries to vaults tied to Privileged Access Management accounts.
4. Upon end-user usage, passwords are automatically rotated, minimizing attack potential.