Many remote-desktop products initiate outbound connections to vendor infrastructure, allowing sessions without exposing a conventional inbound listening port. This creates an externally mediated access path when the client is running, can reach the service, and is configured to accept the requested connection. Interactive approval, unattended-access state, passwords or account assignment, multifactor authentication, allowlists, permission profiles, conditional-access policy, and network egress controls can all affect whether the path is usable. Review relay reachability and client authorization together rather than treating installation alone as internet exposure.
Subtopics#
- External reachability: relay-mediated connectivity and its control points.
- Insecure configuration: settings that weaken incoming-session authorization.