LDAP, RPC, and RDP exposure keeps lateral movement too easy

At a glance

What this is: This is an analysis of how common remote management protocols, especially LDAP, RPC, and RDP, create hidden attack paths that attackers can reuse for foothold, privilege escalation, and lateral movement.

Why it matters: It matters because IAM, PAM, and segmentation teams have to govern not only identities and credentials, but also the network pathways those identities use for privileged activity and administrator access.

By the numbers:

• More than 600 million cyberattacks occur globally each day.

👉 Read Zero Networks' analysis of LDAP, RPC, and RDP exposure

Context

LDAP, RPC, and RDP are ordinary operational protocols, but they become security liabilities when they remain broadly reachable across the environment. The problem is not that these protocols exist, but that they often stay open by default because operations depend on them for authentication, administration, and service communication.

That creates a governance gap for identity and access teams: privileged access is no longer only a question of who has credentials, but also which paths those credentials can use. Once an attacker lands anywhere with network reach, these protocols can become a bridge from one system to the next, especially where standing access and broad administrative trust still exist.

Key questions

Q: How should security teams secure LDAP, RPC, and RDP without breaking operations?

A: Start by separating necessary management paths from blanket network reachability. Allow only the identities, hosts, and remote operations that are genuinely required, then close everything else by default. Pair segmentation with just-in-time access so administration remains possible, but only within a narrowly scoped, time-bound window.

Q: Why do exposed management protocols increase lateral movement risk?

A: Because they turn valid credentials into reusable movement paths. Once an attacker reaches one system, protocols such as LDAP, RPC, and RDP can reveal trust relationships, permit remote execution, or enable interactive logins that look like normal administration. That is why transport exposure and identity scope must be governed together.

Q: What do teams get wrong about MFA for server access?

A: They often treat MFA as a stand-alone login control instead of part of a broader governance chain. For VMs, the real risk is not only stolen credentials. It is unmanaged exceptions, weak context, and poor visibility into who accessed what, from where, and under which policy conditions.

Q: Who is accountable when RDP or RPC exposure leads to compromise?

A: Accountability usually spans IAM, PAM, infrastructure, and network security, because the failure is shared across identity policy and protocol exposure. The control owner should be the team that can actually limit reachability, define approved remote operations, and revoke access when the task is complete.

Technical breakdown

Why LDAP exposure turns identity data into reconnaissance fuel

LDAP is tightly bound to directory services, so it exposes a rich map of users, groups, computers, services, policies, and certificate-related objects. When access is overly permissive, attackers can query the directory for relationships that reveal where privilege lives and how trust is structured. That is why LDAP abuse often precedes escalation or persistence. The issue is not only exploitability, but also the operational assumption that directory visibility is harmless to anyone on the network.

Practical implication: restrict which systems and identities can query directory services and treat LDAP operations as privileged activity, not background noise.

How RPC expands the attack surface for remote execution

RPC is a transport for many Windows management functions, which makes it operationally convenient and security-expensive. Because organisations often allow broad RPC traffic rather than selecting individual services, attackers can reach remote scheduling, service creation, WMI, DCOM, and other management paths with stolen credentials or a vulnerability. Dynamic endpoints make this harder to reason about because exposure can shift with service state. The result is an oversized remote execution surface that defenders rarely enumerate precisely enough.

Practical implication: inventory exposed RPC operations and limit remote management to the smallest viable service set, especially on domain controllers and management hosts.

Why RDP remains a privileged access problem, not just a remote login issue

RDP is interactive, which makes it a high-value control point for administrators and attackers alike. If passwords are weak or credentials are compromised, brute force and credential stuffing can open a direct path into sensitive systems. Once inside, the attacker can disable tooling, move laterally, or deploy ransomware manually while blending in with expected admin behaviour. Layer 7 MFA alone does not solve the exposure problem if the port remains reachable and the access window stays open continuously.

Practical implication: apply network-layer just-in-time verification and default-deny reachability for RDP rather than relying on authentication at the application layer alone.

Threat narrative

Attacker objective: The attacker aims to convert legitimate management pathways into a reliable route for privilege escalation, lateral movement, and eventual control of sensitive systems.

1. Entry begins when attackers use exposed RDP, RPC, or LDAP paths to gain a foothold through weak credentials, stolen access, or protocol abuse.
2. Escalation follows when directory queries, remote management functions, or service control paths reveal privilege relationships or allow remote execution.
3. Impact occurs when the attacker pivots laterally, disables controls, exfiltrates data, or deploys ransomware across reachable hosts.

Breaches seen in the wild

• MITRE ATT&CK Enterprise Matrix — MITRE ATT&CK Enterprise — adversary tactics and techniques, threat detection, attack chain mapping, credential access, lateral movement, privilege escalation.
• Coupang Signing Key Breach — Unrevoked signing key credentials expose 33.7 million records after employee offboarding failure at Coupang.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Standing remote management trust is the real governance failure: LDAP, RPC, and RDP are not risky because they exist. They are risky because too many environments still treat persistent reachability as operationally harmless. That assumption breaks identity governance, PAM, and segmentation at the same point: the network path remains open long after the legitimate need has ended. Practitioners should reframe these protocols as privileged access surfaces, not convenience features.

Identity controls fail when the transport layer stays permissive: A credential can be valid and still unsafe if the network path behind it is unconstrained. That is why port-based exposure, remote management scope, and administrative reachability must be governed together. The field should stop treating authentication and transport as separate problems when attackers chain them in one move.

Blast radius is the right concept for protocol governance: The article’s strongest operational lesson is not that defenders must block every port, but that they must define how far one compromised identity can travel. Microsegmentation, just-in-time verification, and protocol-specific policy all point to the same principle. If a management protocol can touch everything, then the environment has already granted the attacker a wide blast radius.

Network-layer just-in-time control is now part of identity governance: RDP and similar protocols expose a gap in older IAM thinking, where access review and authentication were expected to cover the whole problem. They do not. Governance now has to extend to the path, the timing, and the duration of access, because standing connectivity converts legitimate admin workflows into attacker-friendly persistence channels.

From our research:

• 1 in 4 organisations are already investing in dedicated NHI security capabilities, with an additional 60% planning to do so within the next twelve months, according to The State of Non-Human Identity Security.
• Only 1.5 out of 10 organisations are highly confident in their ability to secure NHIs, compared to nearly 1 in 4 for securing human identities.
• That confidence gap points to a broader governance shift, which is explored in Ultimate Guide to NHIs , Key Challenges and Risks.

What this signals

Protocol reachability is now an identity problem as much as a network problem: teams that still treat remote management ports as always-on utilities will keep widening their blast radius. The practical response is to align segmentation, PAM, and access governance around the paths privileged identities actually use, not just the accounts they possess.

With 85% of organisations lacking full visibility into third-party vendors connected via OAuth apps, the wider governance lesson is clear: unmanaged access paths, whether API-based or protocol-based, are where control assumptions fail first.

Identity blast radius: the amount of infrastructure a single privileged credential can reach before governance or segmentation stops it. If that radius is not measured, teams will keep discovering exposure only after an attacker has already started moving.

For practitioners

• Classify remote management protocols as privileged access surfaces Inventory LDAP, RPC, and RDP reachability alongside admin entitlements, then assign owners for each exposed path. Review which systems still allow broad east-west access and remove paths that exist only for convenience.
• Apply default-deny reachability for administrative ports Use segmentation rules so privileged ports are closed unless a specific identity, system, and task require them. Keep the policy tied to the use case rather than leaving it open for all authenticated users.
• Move RDP verification to the network layer Require just-in-time approval or verification before RDP sessions open, then close the path again when the task ends. Do not rely on application-layer MFA alone to compensate for always-on exposure.
• Limit RPC operations by function, not just by host Document which RPC calls are actually needed on domain controllers and management servers, then block the rest. Where possible, inspect RPC context so remote service creation, registry modification, and WMI are not broadly available.
• Audit LDAP operations for recon and abuse patterns Baseline normal LDAP activity, then flag remote queries that expose directory structure, certificate attributes, or DACL manipulation paths. Treat directory access as an identity control signal, not just a logging event.

Key takeaways

• LDAP, RPC, and RDP are operationally legitimate but security-expensive because they can double as attacker movement paths.
• The key control problem is not only authentication, but standing reachability and excessive protocol scope across the environment.
• Teams that want to reduce lateral movement need segmentation, just-in-time access, and protocol-level policy that closes management paths by default.

Key terms

• Protocol Reachability: The set of network paths through which an identity can interact with a service. In identity security, reachability matters as much as authentication because a valid credential is still dangerous if the service is broadly exposed and not limited by task, host, or time.
• Identity Blast Radius: The amount of infrastructure a single identity can influence before controls stop it. For remote management protocols, blast radius grows when one account can touch many systems, making segmentation and just-in-time access essential to contain abuse.
• JIT — Just-in-Time Access: A security approach that grants access permissions only for the duration needed to complete a specific task, then automatically revokes them. JIT access eliminates standing privileges for NHIs, dramatically reducing attack surface.

What's in the full article

Zero Networks' full article covers the operational detail this post intentionally leaves for the source:

• Protocol-by-protocol guidance for LDAP, RPC, and RDP exposure in production environments
• Step-by-step segmentation and firewall policy examples for reducing administrative reachability
• Operational patterns for just-in-time MFA and network-layer access enforcement
• Implementation detail on RPC Firewall and LDAP firewall policy baselining

👉 The full Zero Networks article covers protocol-specific controls, segmentation patterns, and access hardening detail.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.