Security Fix: Custom Actions Now Require Admin Privileges

In RdpGuard 9.9.9 and earlier, local standard users could configure custom actions that launched programs through the RdpGuard service. Because the service runs as SYSTEM, this allowed local privilege escalation.

RdpGuard 10.0.5 restricted configuring and testing custom actions in the interface to administrators. The service also checks administrator privileges when saving custom action settings.

To modify custom actions, run RdpGuard as administrator. If the administrator warning appears, click Restart as administrator and approve the Windows prompt.

If your custom actions were disabled after updating to RdpGuard 10.3.7, the update found unsafe permissions on their settings file or folder. RdpGuard now protects these settings and displays a warning in Dashboard until an administrator reviews and saves the actions.

Those permissions could have allowed a standard user to change actions that run with SYSTEM privileges. Disabling them is a precaution so an administrator can check them before they run again. The warning itself is not evidence that your server was compromised.

Review and restore your custom actions

1. Run RdpGuard Dashboard as administrator and open Custom Actions.
2. Review each action and its settings. For programs or scripts, check the command, arguments and referenced files, including who can modify them.
3. Enable only the actions you need and trust, then click Save changes.

You can also leave the actions disabled and save the list. The Dashboard warning clears after an administrator saves the reviewed list; simply opening the dialog or restarting RdpGuard does not clear it.