RDP Session to Unmanaged or Non-TPM Device

Robbe Van den Daele@RobbeVdDaele

•updated Aug 19, 2025•6•0•70

This rule detects RDP sessions initiated from managed devices to unmanaged devices or devices that do not have a Trusted Platform Module (TPM) enabled or supported. This can pose a security risk, especially when Windows Hello for Business credentials are used, as the keys might not be adequately protected on the destination device.