Skip to content
Home » Help Center » Prixl Guard (Secure Access) guides » Lock Remote Desktop to Secure Access only (without locking yourself out)

Lock Remote Desktop to Secure Access only (without locking yourself out)

What you will do: close Remote Desktop to the internet so that only your office network, staff connected through Guard and your Trusted IPs can reach it. The order matters. You first prove that Guard works for you, then add a fallback, and only then switch the lock on. Done in this order, you will not lock yourself out.

Time: about 15 minutes, including the tests. You need: Guard set up on the server, at least one person (ideally you) who has installed Guard and connected (see Invite a staff member and the staff guide), and a way to reach the server that does not depend on Guard: someone at the office, or your cloud provider’s console if the server is in the cloud.

What the lock changes

When you switch on Lock RDP to Secure Access only, Warden changes the Windows Firewall on the server. Remote Desktop stays reachable from the office network (LAN), from staff connected through Guard and from addresses on your Trusted IPs list. Connections from the rest of the internet are blocked. Warden also switches off Windows’ built-in Remote Desktop allow rules so they cannot undo the lock.

Steps

First: prove Guard works for you

  1. Open the Warden dashboard on the server with the desktop shortcut Prixl Warden Dashboard and click Secure Access.
  2. Check that the person who will test (you, or a trusted colleague) is listed in the Connected Peers table.
  3. On that person’s laptop, connect Guard, then open Remote Desktop to the address shown at the top of the Secure Access tab after After connecting, RDP to:. Sign in. The best test is from outside the office, for example over a mobile hotspot, because inside the office Remote Desktop would work anyway.

Do not go further until this works. If it does not, see Troubleshooting Guard.

Then: add a fallback

  1. Click Trusted IPs in the sidebar. If your office or home has a fixed public IP address, type it in the Add Trusted IP box and click Add. The lock keeps Remote Desktop open to Trusted IPs, so this is your way back in if Guard ever fails. An address that changes from time to time, as many home connections do, will not help here. Details are in Block attackers: manual blocks, auto-block and trusted IPs.
  2. Make sure you know your other way in: a person at the office who can use the server on the office network, or the cloud console for a cloud server.

Last: switch the lock on

  1. Go back to Secure Access and scroll to Secure Access Settings. Do steps 6 to 10 from a session the lock keeps open: at the server itself, on the office network, over Guard, or from a Trusted IP. Do not do them over a direct internet Remote Desktop connection; that is the connection the lock closes.
  2. Turn on Lock RDP to Secure Access only.
  3. Decide on Auto-unlock on tunnel failure. It is off by default. Read the trade-off below before you change it.
  4. Leave Unlock RDP on service stop on (its default). It opens Remote Desktop again if the Warden service stops or is uninstalled, so a stopped service cannot leave you shut out.
  5. Click Save Settings. With auto-unlock off, the dashboard asks you to confirm. With the default switches the message begins “Warning: Auto-unlock on tunnel failure is disabled. If the VPN tunnel goes down, RDP will remain locked.” If you also turned off Unlock RDP on service stop, a stronger warning says you may lose RDP access permanently. Click OK only if you have done steps 1 to 5.

The dashboard shows Settings saved (vN), and your admin addresses get an email saying “Lock RDP to Secure Access: enabled”. An amber note appears under the switch: from now on, change the Remote Desktop port only from this dashboard, not through Windows Settings or the Registry.

Auto-unlock on tunnel failure: the trade-off

This switch decides what happens when Guard stops working for more than 2 minutes. There is no answer that is right for every office.

  • Off (the default): Remote Desktop stays locked. Attackers on the internet still cannot reach it, but nor can staff working from outside until Guard works again. People in the office, Trusted IPs and the cloud console still get in.
  • On: after 2 minutes Warden opens Remote Desktop to the whole internet so nobody is locked out, and locks it again once Guard is back. While that happens, the dashboard can show: “RDP is temporarily open because no Guard peer is connected (your unlock-on-drop setting). It re-locks to VPN automatically once a peer connects.” For that time your server is exposed exactly as it was before Guard.

Our suggestion for most offices: leave it off, keep a Trusted IP or an on-site person as your fallback, and keep Unlock RDP on service stop on. Turn auto-unlock on only if losing remote access for a few hours would hurt you more than a short period of exposure.

Check it worked

  • From the test laptop with Guard connected, Remote Desktop to the “After connecting, RDP to” address still works.
  • If staff used to connect straight to the office’s public address, try that from outside the office with Guard disconnected. It no longer connects (unless that laptop’s address is a Trusted IP).
  • Your admin addresses received the “Lock RDP to Secure Access: enabled” email.

How to undo the lock

  1. Open the dashboard on the server (from the office network, a Trusted IP, over Guard or through the cloud console).
  2. In Secure Access Settings, turn off Lock RDP to Secure Access only.
  3. Click Save Settings. Turning the lock off is always allowed. Warden applies it on its next cycle and emails your admins “Lock RDP to Secure Access: DISABLED – RDP is now accessible from the internet”.

If you are locked out and have no way to reach the server at all, use the contact form (licensed customers can use the support address they were given). Prixl support can send an emergency unlock to your server. Your admins get an email “Emergency Remote Desktop unlock requested”, and it takes effect within about 5 minutes.

If something goes wrong

  • “Cannot lock RDP – no Guard peers are configured. Create a Guard invite and have a peer redeem it first.”: nobody has used an invite yet. The switch flips back off. Do steps 1 to 3 first.
  • Red banner “RDP lock is configured ON but NOT active”: turn the lock off and on again and save, or contact support.
  • Staff on Guard cannot reach Remote Desktop after the lock: check that they use the “After connecting, RDP to” address and port. Do not restrict the Remote Desktop port with LAN only on the Open Ports tab; that option shuts out Guard users. If you use Open Ports for it, choose LAN + Guard. See Troubleshooting Guard.

Next

Previous: For staff: install Guard and connect. Next: Revoke access, replace a laptop, re-invite. Back to Prixl Guard (Secure Access) guides.