Remote Desktop Protocol, RDP, is becoming a common entry point for bad actors, including many POS terminal breaches, and the main delivery method for enterprise-grade ransomware, like SAMSAM. An underground economy has developed around finding and then selling credentials to access various organizations through RDP.
Though it is a legitimate tool for administering Windows systems remotely, RDP should never be exposed directly to the internet. Firewalls should be configured to disallow RDP access from Internet sources, and systems that run RDP must not permit accounts with default or weak passwords.
Use a service like Shodan to scan your organization’s address ranges to identify RDP services exposed to the Internet. Workstations should be configured via GPO to disable RDP, enabling it only by exception.