Is it safe to keep an autologin account for my server?

Question

I have a pc with Windows XP Professional on it an I have configured it so I can log into it by Remote Desktop Connection. I have not opened any port on my router firewall and I only RDC locally (from other pc/laptop in home network). Is my pc safe this way? What can I do to improve safety if needed?

Answer 1

If you are allowing autologin where the system simply boots and supplies itself with a login/password and goes to the desktop without intervention - this is not secure. Anyone with physical access could boot the system and get access with no protections for you. You need a decent login name and password and preferably set the computer to require it, and also require a Ctrl-Alt-Del and not keep the name of the previous user. Disable fast user switching so you can't have sessions running in the background.

As far as RDP, if you want to increase security, use user-accounts and set only a limited number of logins to have remote access ability. Change the RDP port number from 3389 to an alternate address. If you happen to have a firewall hole, anyone malicious would almost certainly scan the usual ports - 137-139, 445, 3389... By changing to an alternete port, it makes it that much more secure.

Answer 2

Simply put: NO. Putting a password will make it more secure. Sure you're the only one that accesses your network, but there's always the what if. It's like closing your door without locking it and thinking that a thief won't try to get in. Will it happen? Who knows, but it's always better to be safe than sorry.