Which of the following is NOT a recommended best practice for securing Terminal Services and Remote Desktop?

Requiring TLS authentication and encryption is a well-established best practice that protects RDP sessions from eavesdropping and man-in-the-middle attacks.

Exposing TCP port 3389 (RDP) on the external firewall to all traffic makes the Terminal Services endpoint directly reachable from the internet, dramatically increasing the attack surface for brute-force, credential stuffing, and exploit attacks such as BlueKeep. Best practice is to restrict RDP access to trusted IP ranges, place it behind a VPN or RD Gateway, and never expose it openly on the external firewall.

Using Group Policy to lock down virtual desktops of thin-client users limits the attack surface within sessions, which is a recognized hardening measure.

Layering IPSec or a VPN over RDP encryption provides defense-in-depth for sensitive environments, which is a recommended security practice.