My first question so please be gentle :)

I have a client who is insisting that they have to let their third party vendor support access to there server directly from the internet via RDP.

Our policy does not allow direct access to the infrastructure from outside of the data centre for administration except from an approved VPN connection and then virtual desktop there on to the servers.

I am now in the situation where I must give good reasons why it is dangerous to use RDP over the public internet.

any help would be appreciated

Thanks in advance

Stuart