If we can make it secure enough, allow RDP-ing into that VM (with only RDP traffic allowed) I'm pretty sure CVE-2019-0708 would work on Windows Server 2000 and an EOL patch was not released, allowing RCE on that box where a threat actor could easily pull the AD creds of users and further exploit your environment. I would not recommend this. Thanks for the comment, understood. This doesn't quite apply to my situation and goals. The RDP access will only be open to specific IPs. Not to the entire network, VLANs or subnets. Just IPs. The server isn't domain-joined, there's nothing to pull. It'll be powered down most of the time, awaken only on request. It's read-only in a sense there's no new data written to it. If someone malicious manages to get in, and it goes up in smoke, no biggie. Restore a month-old version from backup or a snapshot. The security part isn't to protect that server, it's to protect the network in case the server is already loaded with malware. Far as I can tell, the precautions I am taking with everyone's help here would keep this setup reasonably secure. In terms of your kind suggestion to finally retire the damn thing: sounds like you're fully behind the idea of reducing technical debt and minimizing high effort useless tasks. Me too! 😎 Thanks again!
... View more
