How long large enterprise takes to move to a new windows has been studied and published. The typical update is close to 4-5 years. Hell, many shops only recently moved from XP to 7. Hell, Win7 is almost seven years old!<p>&gt;You use any non-Win10 RDP client and enter the username with the blank password.<p>What username? What code generates the correct name? That&#x27;s what I was referring to. Say there is a win10 pro machine with rdp enabled for the account &#x27;jmpendergrast&#x27; with no password and listening to 3389 with no firewall blocking it. Wonderful, how many passess until you guess that? Where is the automation code?<p>Note, by default windows will not let you use a password-less account for RDP:<p><a href="https:&#x2F;&#x2F;support.microsoft.com&#x2F;en-us&#x2F;kb&#x2F;303846" rel="nofollow">https:&#x2F;&#x2F;support.microsoft.com&#x2F;en-us&#x2F;kb&#x2F;303846</a><p>So that&#x27;s another hurdle someone has to get through.<p>Also, when RDP is enabled, it default to the newer versions which don&#x27;t have this bug. You need to specify legacy access as well. Another hurdle.<p>So let me summarize what needs to happen for this attack to work: Win10 needs RDP enabled with legacy access explicitly allowing non-NLA connections. Then Win10 needs a firewal rule for 3389 from its router or put on the internet without a NAT&#x2F;Firewall.  Then Win10 needs someone to make an account with a password (passwords are mandatory for rdp). Then someone needs to change the registry to allow blank passwords for a RDP user. Then that user needs to remove the password from that account. Then that user needs to be put in the RDP group.<p>And if a home user does this, he or she isn&#x27;t using a local account they&#x27;re probably using a MSN account.<p>This is very much an edge case here.<p>&gt;RDP seems like a shitty remote access protocol wrt security, but VPN products are certainly worse than OpenSSH.<p>Everything sucks but FOSS right? How non-biased of you. I won&#x27;t mention heartbleed and shellshock then.