Let staff reach the office server from home.
Keep Remote Desktop off the internet.
Prixl Guard gives each person you invite a private, encrypted connection to your office server. They use Remote Desktop exactly as before, and you can close Remote Desktop to the rest of the internet. No static IP, no router changes.
The free trial covers Prixl Warden. Guard comes with the Warden + Guard plan: request a demo or an invoice.
The problem with opening Remote Desktop to the internet
Tax season, and half the office wants to work from home. They need Tally and the client files on the office server, so someone asks the IT vendor to make Remote Desktop work from outside. The quick way is a port forward on the router: port 3389 goes straight to the server, and anyone can reach its sign-in screen from anywhere.
Anyone includes the automated tools that scan the whole internet for that screen and start guessing passwords. When Sophos put test servers with Remote Desktop online, the first guess arrived 1 minute 24 seconds later (Sophos, 2019). In the attacks its incident response team handled in 2023, criminals abused Remote Desktop in 90% of cases, and external remote services such as Remote Desktop were the way in for 65% (Sophos Active Adversary Report, 2024).
Moving Remote Desktop to another port only cuts the noise in the logs; scanners find it anyway (why a port change is not enough). A traditional VPN closes the door, but most need a port forward and a public IP address, and some office broadband connections in India sit behind the provider’s shared address (CGNAT), where a port forward cannot work. Our guide to locking down Remote Desktop covers every option. Guard is the one we built for small offices.
How it works
Four steps, once per person. You stay in charge of who gets in.
1
Invite
In the Warden dashboard on your server, open the Secure Access tab, type the person’s name (and email, if you want Prixl to send it to them) and click Create Invite.
2
Code
They get a one-time invite code. It works once and expires after 24 hours. After that it is worthless.
3
Connect
They install the Prixl Guard app on their Windows laptop, paste the code and click Connect. Guard sits in the system tray.
4
Remote Desktop
They open Remote Desktop and connect to the server address Guard shows. Windows still asks for their normal password.
After the first day there is nothing to set up again. Staff open Prixl Guard from the Start menu and it connects on its own; the tray menu shows the address to use: “Connected – RDP to” followed by the server’s address.
Lock RDP to Secure Access only
This is the step that takes Remote Desktop off the internet: once staff connect through Guard, Remote Desktop no longer needs to face the internet.
What it does
Switch on “Lock RDP to Secure Access only” in the Secure Access tab and click Save Settings. Warden then changes Windows Firewall so Remote Desktop answers only the office network, people connected through Guard, and any addresses you list under Trusted IPs. Connections from the rest of the internet are blocked.
Built not to lock you out
- Guard will not lock Remote Desktop until at least one person has redeemed an invite.
- Add your own office or home address under Trusted IPs as a fallback before you lock.
- “Unlock RDP on service stop” is on by default: if Warden stops or is removed, Remote Desktop opens again.
- “Auto-unlock on tunnel failure” is off by default. Switched on, it reopens Remote Desktop to the whole internet whenever the Guard connection is down for more than 2 minutes. You choose.
Follow the step-by-step guide: Lock Remote Desktop to Secure Access only, without locking yourself out.
No static IP. No port forwarding.
Guard has two connection methods. Most offices never change the default.
Prixl Magic (the default)
No router setup and no static IP. Guard connects the laptop and the server directly, and works behind most office routers and behind the shared addresses (CGNAT) many broadband and mobile connections use. When a direct connection is not possible, Guard switches to an automatic relay. The relay only carries encrypted traffic.
Classic Static IP
For servers that already have a real public IP address. Your router forwards UDP port 51820 to the server and staff connect straight to it. Pick it only if your IT vendor has that set up; you can switch between the two methods any time from the Secure Access tab, and staff apps follow on their own.
More detail: how Guard works and changing the connection method.
You stay in control
Revoke in one click
Someone leaves, or a laptop goes missing? Click Revoke next to their name under Connected Peers. That device loses access within about a minute. To replace a laptop, invite the new one first, then revoke the old one.
You hear about every change
Prixl emails your admins when an invite is created, when someone is revoked, and when the Remote Desktop lock is switched on or off. The changes are also kept in the dashboard’s activity log.
Your sessions stay yours
Each laptop makes its own key; only the public half is sent to Prixl. Prixl does not see what happens in a Remote Desktop session, and the relay, when used, only passes encrypted traffic.
Seats, pricing and what you need
Seats and pricing
- A seat is one person (one device) who has redeemed an invite. Pending invites do not count.
- Seats are shared across your organisation, on every server that runs Guard.
- The Warden + Guard plan (₹14,999 a year per server) includes 5 seats. Extra seats are ₹600 per seat per year up to seat 25, less after that.
- Guard comes with the Warden + Guard plan. It is not part of the free trial.
See pricing for larger teams, or ask us for a demo or an invoice.
What you need
- Prixl Warden on the office server (Windows 10 or 11, or Windows Server 2016 or newer). Guard is set up by Warden once your plan includes it; there is nothing else to install on the server.
- Staff: a Windows laptop or PC, 64-bit. Installing and starting the app needs Windows administrator rights, so Windows shows an administrator prompt each time Guard starts.
- An internet connection at the office and wherever the staff member is working.
- Mac, iPhone and Android are not supported yet. Neither are Windows laptops with ARM processors.
Questions owners ask
Do we need a static IP or changes on the office router?
No. The default method, Prixl Magic, needs neither, and it works behind most office routers and behind CGNAT. If a direct connection cannot be made, Guard uses an automatic relay. A static IP with a port forward is only needed if you choose the Classic Static IP method.
Is Guard the same as two-factor sign-in?
Not quite. Guard does not ask for a one-time code. It decides who can reach the server at all: once Remote Desktop is locked, only invited devices (plus your office network and Trusted IPs) get as far as the Windows sign-in, and each person still needs their Windows password. Use strong passwords as well; Guard does not replace them.
What happens when someone leaves the firm or loses a laptop?
Open the Secure Access tab and click Revoke next to their device. It is cut off within about a minute and the seat is free again. Guard will not let you revoke the last active device in your whole organisation, a guard against locking everyone out by mistake. See revoke access, replace a laptop, re-invite.
Can staff connect from a Mac, an iPhone or an Android phone?
Not yet. The Guard app runs on 64-bit Windows only. A staff member on a Mac or a phone cannot use Guard today.
Is Guard included in the 30-day free trial?
No. The trial covers Prixl Warden: monitoring, alerts and the security audit. Guard comes with the Warden + Guard plan. Contact us for a demo or an invoice.
Can Prixl see what my staff do on the server?
No. Each laptop creates its own key and only the public half is sent to Prixl. Prixl’s cloud keeps what it needs to connect people, such as names from the invites, device keys, the tunnel address each device was given and when it was last seen, but never the content of a Remote Desktop session. When the relay is used, it only passes encrypted traffic.
Step-by-step guides for admins and staff are in the Help Center, including a printable guide for staff and troubleshooting.
Close Remote Desktop to the internet
before the next tax season.
Start with Prixl Warden to see who is trying to get in today. Guard comes with the Warden + Guard plan: ask us for a demo or an invoice.