Port 2701 – SMS/SCCM Remote Control (CmRcService)

Port 2701 is the default port for the SMS/SCCM Remote Control agent — the Microsoft Systems Management Server (SMS) / System Center Configuration Manager (SCCM, now MECM / ConfigMgr) service CmRcService.exe. The agent listens on TCP 2701 so a Configuration Manager administrator can remotely view and take control of a managed endpoint’s desktop straight from the ConfigMgr console — the built-in “Remote Control” help-desk feature. IANA registers the port as sms-rcinfo, and the “SMS” here means Microsoft’s management platform, not text messaging. In practice an open port 2701 almost always means a ConfigMgr-managed Windows client with the Remote Control feature enabled.

Why It’s Open

Port 2701 is open because the host is a ConfigMgr/MECM client and remote control was switched on in the site’s client settings. IT and help-desk staff use it to shadow or fully drive a user’s live desktop for support, exactly like a built-in VNC. CmRcService.exe installs under C:\Windows\CCM\RemCtrl and starts listening on 2701; setting up a session also involves RPC on port 135, and the client talks to its ConfigMgr management point over HTTP on port 80 or HTTPS on port 443 plus SMB on port 445 for content and policy. Remote control authenticates with Kerberos and falls back to the weaker NTLM if Kerberos fails. You’ll see 2701 across enterprise Windows fleets — desktops, laptops, and servers — anywhere ConfigMgr is the endpoint-management platform and the remote-tools client setting is left at its default of enabled.

Common Risks

• Interactive desktop takeover channel. Remote control gives full view-and-control of a user’s live session. Whoever can reach 2701 and pass the permission checks is effectively sitting at the keyboard.
• Silent or unattended access. If the client setting doesn’t require the user’s permission — or doesn’t show the on-screen notification and connection bar — a session can open with the user unaware. “Grant remote control of an unattended computer” widens this further.
• Over-broad permitted viewers. Membership of the local ConfigMgr Remote Control Users group (or an over-large permitted-viewers list) decides who can connect. Too many members, or a domain group nested inside it, is a large monitoring/takeover surface.
• Post-compromise abuse as native VNC. A local admin can rewrite the CCM_RemoteToolsConfig WMI class to disable the prompt, notification, and audible signal and add themselves as a permitted viewer, then connect over 2701 using the endpoint’s own trusted, signed agent — a stealthy remote-control channel that survives even when remote control looks “disabled” in the console.
• Weak legacy auth. NTLM fallback exposes the session to relay and pass-the-hash style abuse where Kerberos isn’t strictly enforced.
• A window onto the wider SCCM attack surface. An exposed 2701 marks a ConfigMgr client, and ConfigMgr itself is a top lateral-movement and privilege-escalation target in Active Directory — NTLM relay to the site database or AD CS can lead to full site takeover. That risk lives in the ConfigMgr fabric (management point, site server, SQL), not in the 2701 agent itself, but the two travel together.

Want to save time on reporting?

Let PentestPad generate, track, and export your reports - automatically.

Book a Demo

Enumeration & Testing

For a defender, the goal on 2701 is to confirm which hosts are ConfigMgr-managed, whether remote control is enabled, and how tightly the consent and permitted-viewer settings are configured.

Detect the service and confirm a ConfigMgr client

nmap -sV -p 2701 <target>

An open 2701 is a strong signal that the host is a ConfigMgr/MECM client with the Remote Control agent running. Pair it with a scan of RPC port 135, which the remote-control session setup also uses.

Sweep a subnet for managed endpoints

nmap -p 2701,135 --open <cidr>

Review who can connect (on the endpoint)

# Local group that gates remote control
net localgroup "ConfigMgr Remote Control Users"

# Effective remote-tools configuration pushed by the client settings
Get-WmiObject -Namespace root\ccm\clientsdk -Class CCM_RemoteToolsConfig | `
  Select-Object PermissionRequired, AudibleSignal, `
                AllowRemCtrlToUnattended, AllowClientChange, ClipboardAccessPermissionRequired

PermissionRequired = 0 (no user consent), AudibleSignal/notification disabled, or AllowRemCtrlToUnattended = 1 are the settings a defender wants to catch. The open-source CmRcAuth tool performs an access check against CmRcService.exe to enumerate who is actually permitted to remote-control a given client.

Record every ConfigMgr-managed host and its remote-control posture as you go, so the findings land in the pentest report instead of a scratch terminal.

What to Look For

Known CVEs and Exploits

The 2701 remote-control agent has very few dedicated CVEs — its real-world risk is misconfiguration and the broader SCCM attack surface, not a single exploitable bug. Be wary of “port 2701 CVE” lists online: many circulate CVE IDs that actually belong to unrelated products.

• CVE-2004-0728 — The Remote Control Client service in Microsoft SMS 2.50.2726.0 lets a remote attacker crash the service (denial of service) with a crafted packet to TCP port 2702 that forces an invalid memory read/write. Historical, and on the adjacent data port, but it is a genuine flaw in the same SMS Remote Control service family. CVSS 5.0.
• CVE-2022-37972 — Microsoft Endpoint Configuration Manager (MECM/SCCM 2103–2207) spoofing vulnerability tied to the “Allow connection fallback to NTLM” client-push behaviour, letting an unauthenticated attacker coerce and abuse NTLM authentication. CVSS 7.5. This is a ConfigMgr fabric issue — client push / NTLM — not a bug in the 2701 remote-control agent, but it is why NTLM relay against SCCM is such a common domain-takeover technique.

Beyond CVEs, the practical “exploit” for 2701 is abuse of the feature itself: reconfiguring CCM_RemoteToolsConfig to silence prompts and self-authorize, then using remote control as a covert VNC. The broader SCCM privilege-escalation playbook (NTLM relay to the site database or AD CS, catalogued in the community Misconfiguration Manager project) is a technique, not a single CVE, and depends on the management point / site server rather than 2701.

Mitigation

• Disable Remote Control where it isn’t needed. In the ConfigMgr console, turn off the Remote Tools client setting for device collections that don’t require help-desk takeover. New builds no longer need it enabled everywhere.
• Require consent and make sessions visible. Set remote control to require the user’s permission, and keep the on-screen notification, session connection bar, and audible signal enabled so a takeover can’t happen silently. Avoid granting control of unattended machines.
• Tighten the permitted viewers. Keep the ConfigMgr Remote Control Users group / permitted-viewers list minimal, review it regularly, and avoid nesting broad domain groups inside it.
• Restrict ConfigMgr admin rights. Limit who holds the Full Administrator and other high-privilege ConfigMgr roles — that population effectively controls every managed endpoint.
• Segment and firewall the fabric. Allow TCP 2701 only from designated help-desk/management source ranges, and isolate the ConfigMgr site server, management point, and SQL database from general user networks.
• Harden ConfigMgr against NTLM relay. Enforce Kerberos and disable NTLM fallback where possible, enable SMB signing and Extended Protection / channel binding, and move the management point to HTTPS/PKI — the same hardening that closes the site-takeover paths.
• Patch clients and monitor. Keep ConfigMgr clients current, and watch for CmRcService starts from unexpected contexts, edits to CCM_RemoteToolsConfig, and new members of the Remote Control Users group.

Real-World Example

Security researchers have shown that SCCM Remote Control can be turned into a stealthy takeover tool on a host an attacker already has local admin on. By rewriting the CCM_RemoteToolsConfig WMI class, they disable the permission prompt, notification, and audible signal, add their own account to the permitted viewers, and then connect over TCP 2701 — driving the desktop through the endpoint’s own signed, trusted CmRcService.exe, with none of the usual visual cues to the user. Because the traffic and binary are legitimate ConfigMgr components, it blends into normal management activity. The same body of research (and the community Misconfiguration Manager project) documents how ConfigMgr more broadly becomes a domain-wide privilege-escalation path via NTLM relay to the site database and AD CS. The lesson for defenders: an open 2701 isn’t just a help-desk convenience — it marks a managed endpoint whose remote-control settings, and the ConfigMgr fabric behind it, need to be locked down.

FAQ

What is port 2701 used for?

Port 2701 is the listening port for the Microsoft SMS/SCCM (ConfigMgr/MECM) Remote Control agent, CmRcService.exe. It lets a Configuration Manager administrator remotely view and control a managed Windows endpoint’s desktop from the ConfigMgr console. IANA registers it as sms-rcinfo.

Is port 2701 dangerous?

It’s sensitive rather than inherently exploitable. Port 2701 is a full remote-desktop-control channel, so weak configuration — no user consent, no notification, an over-broad permitted-viewers list, or NTLM fallback — turns it into a quiet takeover path. An open 2701 also flags a ConfigMgr-managed host, and ConfigMgr is a high-value target for lateral movement in Active Directory.

What service runs on port 2701?

The SMS/SCCM Remote Control service, CmRcService.exe, part of the Configuration Manager client. It’s the “Remote Control” help-desk feature that shadows or takes over a managed desktop, authenticating with Kerberos (or NTLM as a fallback).

How do I secure or close port 2701?

Disable the Remote Tools client setting where remote control isn’t needed, require user permission plus an on-screen notification for every session, keep the ConfigMgr Remote Control Users list small, and firewall TCP 2701 to help-desk source ranges only. Harden the wider ConfigMgr fabric against NTLM relay, keep clients patched, and rescan with nmap -p 2701 <target> to confirm the port is closed where the feature is off.

TL;DR

• Service: SMS/SCCM (ConfigMgr/MECM) Remote Control — CmRcService.exe, IANA sms-rcinfo
• Default port: 2701/TCP (session setup also uses 135; management point on 80/443, SMB on 445)
• Biggest risk: silent desktop takeover from weak consent/permitted-viewer settings, plus the wider SCCM lateral-movement surface
• Mitigation: disable remote control where unused, require consent + notification, restrict permitted viewers and ConfigMgr admins, firewall 2701, harden ConfigMgr against NTLM relay