Remote access with Windows Server 2012?

Question

VPN

Good time of the day.
Please share your experience in the following questions.
There is a Windows network for ~ 30 jobs. How to make it so that:
1. It was possible to administer Windows Server 2012
via the Internet 2. Again, via the Internet, go and work at workplaces (work from home). Whether it is possible to make it standard means without any Citrix?
I would be very grateful if you poke on the HowTo.

Answer 1

The best way is to organize an Openvpn server even on the same 2012, it will become a separate interface, and will accept clients on a specific port, say 1934, on the router, forward the port for vpn from outside, inside to the server (it’s more secure, and there is no direct access to the server without vpn) we generate client certificates/keys/configs, from the outside we connect with an openvpn client to an external port - voila. we have a secure channel, we connect to any desired port, we throw files, etc., as if we were inside.

Answer 2

Can. Set up remote access on the server.
Further, if you have NAT to access the Internet, then on the router / firewall, forward the tcp / 3389 port to the server. For security, it's best to allow only from specific addresses. User passwords on the server should be made as complex as possible, remote access should be prohibited without "network level authentication".
For greater security, I would first organize a VPN (on the same OpenVPN, for example), then you won’t have to expose the server to the outside - access to it will be through VPN.

Answer 3

decide what you want:
1. remote work with applications on the server using windows server 2012
For this you need a terminal server MS or Citrix (or others)
2. remote connection of users to their PCs in your network using windows server 2012
To do this, you need to organize a remote connection to your network, then everything does not depend on the server.
Depending on what you need - the means are different, and the advice, respectively, will be different.