Mateusz Cegielski
PL
Updated 7 min read

Remote access for vendors: a recorded-session gateway instead of VPN for everyone

A VPN account for a vendor gives them access to the whole network, with no record of what they did, and often for years after the contract ends. A gateway with session recording, time-limited Active Directory accounts and MFA restrict access to specific machines and a specific time window.

Security Networking
Guide Privileged access Part 5 of 5
  1. Privileged accounts in Active Directory: a tiering model without a full PAM rollout
  2. LAPS: a unique local administrator password on every machine
  3. Signing in to admin tools through Active Directory: LDAPS or OIDC
  4. Emergency access accounts: getting in when directory sign-in stops working
  5. Remote access for vendors: a recorded-session gateway instead of VPN for everyone
Whole guide →
Fig. 1. The vendor sees only assigned connections and never learns the passwords, and every session is recorded; the firewall admits traffic to the servers only from the gateway.

An account review before an audit: the group with VPN access contains a dozen vendor accounts. Some are shared by every employee of the support company, several belong to firms whose contracts ended two years ago, and one signed in last week although nobody had ordered any work. Each of these accounts gives access to the whole internal network and leaves no trace beyond the time of the connection.

Vendor access can be narrowed to specific machines, a specific person and a specific time window, with a recording of the session. It takes an access gateway, time-limited accounts in the directory and a simple process for enabling access for the duration of an engagement.

Three access models

ModelRiskControlRecord of actions
Permanent VPNthe vendor’s computer inside the internal network, accounts active for years, often sharedfirewall rules, rarely maintainedconnection time and IP address
Remote desktop through the vendor’s toolan internet-reachable agent on the server, authentication outside the organisation’s controldepends on the tool’s configuration, usually littlea log on the tool vendor’s side
Gateway with session recordingthe gateway is a high-value targetpersonal account with MFA, time window, list of connectionsscreen recording, and for SSH also the typed commands

A permanent VPN is justifiable only for a vendor that runs the whole environment on an ongoing basis under a contract with security requirements. A remote desktop tool installed at a vendor’s request is the hardest to control, because whether it can be used depends on an account on the vendor’s side, not the organisation’s.

The gateway with session recording

The gateway is a server in the DMZ through which the vendor connects to selected machines. The vendor opens a browser, signs in to the gateway with a personal account and a second factor, and sees only the connections assigned to them: remote desktop or SSH to specific servers. The gateway establishes the connection on their behalf.

  • Access to connections, not to the network. The firewall allows traffic to the target servers only from the gateway’s address and only on the ports of the required protocols.
  • Credentials injected by the gateway. The password of the account on the target server is stored in the gateway and supplied automatically. The vendor does not know it.
  • Session recording. Every session is recorded, and recordings go to storage outside the gateway.
  • Personal accounts. Every vendor employee has their own account, even when connecting to the same server as others.
hostname                srv-app-01.corp.example.com
port                    3389
username                vnd-erp-svc          # account on the server, only the gateway knows the password
recording-path          /var/lib/guacamole/recordings
create-recording-path   true
disable-copy            true                 # no copying from the server to the vendor's computer
enable-drive            false                # no drive mapping

In Apache Guacamole a graphical session recording is stored in the gateway’s own format, and the bundled guacenc tool converts it to a video file when it has to be handed to someone. For SSH connections the typescript-path parameter also saves the session as text, which can be searched like any other file.

On the target server, a firewall rule allows Remote Desktop only from the gateway’s address. The main protection is the network firewall between zones; the host rule is a second layer.

New-NetFirewallRule -DisplayName 'RDP from vendor gateway' -Direction Inbound -Protocol TCP -LocalPort 3389 -RemoteAddress 192.0.2.10 -Action Allow

Allow rules in Windows Firewall add up, so the new rule restricts nothing while the default Remote Desktop rules that accept any source are still enabled. They have to be disabled or narrowed.

Time-limited accounts in Active Directory

If the gateway authenticates vendors against Active Directory, vendor accounts live in a separate organisational unit, OU=Vendors, and are disabled by default. The name follows the pattern vnd-<vendor>-<person>, for example vnd-erp-jnowak, and the Manager field points to the employee responsible for the contract with the vendor. That person approves engagements and is the one asked during a review whether the account is still needed. The end of a contract means deleting all of the vendor’s accounts, not just disabling them.

Approving an engagement means three commands: enable the account, set an expiry date, and add a description with the ticket.

$account = 'vnd-erp-jnowak'
Enable-ADAccount -Identity $account
Set-ADAccountExpiration -Identity $account -DateTime '2026-10-16 18:00'
Set-ADUser -Identity $account -Description 'Ticket 4711, work until 2026-10-16'

When the work is finished, the account is disabled with Disable-ADAccount, even if the expiry date has not yet passed. The expiry date is a safety net for when somebody forgets. Clear-ADAccountExpiration is not used on vendor accounts: an account without an expiry date is exactly the state this model is meant to eliminate.

A second factor is required on the gateway, because the vendor’s employee knows the password of their domain account and can write it down or pass it on. The gateway requires a one-time code or sign-in through an identity provider that enforces MFA.

The process

  1. The vendor requests access through the ticketing system: to what, when, for what purpose.
  2. The system owner approves the request.
  3. An administrator enables the account with an expiry date and assigns specific connections on the gateway.
  4. The session runs through the gateway and is recorded.
  5. When the work ends, the account is disabled, and the ticket number is linked to the recording.

Pitfalls

  • The gateway is a high-value target. It reaches many servers and stores credentials. It needs patching, MFA for every account including administrative ones, and a separate administrative account aligned with the tiering model.
  • No gateway path to Tier 0. Vendors have no connections to domain controllers or hypervisors, and the gateway stores no credentials with domain privileges.
  • Clipboard and file transfer. Off by default. Enabled for a specific connection when justified, because they allow data to be taken out.
  • Recordings are personal data. Recording a session processes personal data of the vendor’s employee. It requires informing the vendor in the contract, a defined legal basis and a limited retention period, for example 90 days.

Check your own environment

Enabled vendor accounts with their expiry date and last logon. A good result contains only accounts with an open engagement, each with an AccountExpirationDate within the next few days. An enabled account without an expiry date, or with a LastLogonDate months ago, should be disabled.

Get-ADUser -SearchBase 'OU=Vendors,DC=corp,DC=example,DC=com' -Filter 'Enabled -eq $true' -Properties AccountExpirationDate, LastLogonDate, Description |
    Select-Object SamAccountName, AccountExpirationDate, LastLogonDate, Description

Accounts that have expired but are still enabled, and accounts expiring within 7 days. The first list should be empty; the second shows engagements whose end is worth confirming with the system owner.

$ou = 'OU=Vendors,DC=corp,DC=example,DC=com'
Search-ADAccount -AccountExpired -UsersOnly -SearchBase $ou |
    Where-Object Enabled |
    Select-Object SamAccountName, AccountExpirationDate
Search-ADAccount -AccountExpiring -TimeSpan 7.00:00:00 -UsersOnly -SearchBase $ou |
    Select-Object SamAccountName, AccountExpirationDate

Members of the group that gives vendors VPN access, if one still exists. The target state is an empty group. An account without an expiry date or unused for 90 days is the first to remove from the group.

Get-ADGroupMember -Identity 'GG-VPN-Vendors' -Recursive |
    Get-ADUser -Properties LastLogonDate, AccountExpirationDate |
    Select-Object SamAccountName, Enabled, LastLogonDate, AccountExpirationDate

Remote Desktop reachability of a target server from any workstation other than the gateway. A good result is TcpTestSucceeded : False; True means the server accepts RDP connections from outside the gateway.

Test-NetConnection -ComputerName srv-app-01.corp.example.com -Port 3389