windows 7 - Is Remote Desktop to Workstations Secure?

I have users that want to use remote desktop for remote access to their workstations. I have RADIUS connected VPN server that I use, however I remember to connect and disconnect rather than send web traffic over the VPN.

I doubt they will do this, because the previous IT consultant left them RDP open and didn't even suggest to change passwords such as 1234,password and {insert child/pet name}. Now they have to use the Password policy that R2 ships with , so I know we are more secure in that regard.

So the most important issue is how dangerous is leaving 7 and XP Remote open to the internet?

Answer

If you have passwords set to be of a decent length and complexity, RDP is encrypted, so it for the most part is secure. I personally wouldn't do it, preferring to use something like a Cisco VPN client on workstations then VPN to the workstation rather than leaving it open to the webbertubes. RDP can be susceptible to MITM attacks and you'll probably get bots and scans that will probe them.

I'd also set your policy to lock out accounts if they are tried 3 times with incorrect passwords to prevent/minimize brute force attacks.

Summary: it's probably secure enough to do this, but it's bad practice and should be avoided.

EDIT: there are worms that attack RDP, so you'll want to be mindful of this in enforcing your policies. I.e., Morto.