Enabling Remote Desktop

My question: How secure is the RDP protocol in a workgroup environment that is behind NAT and firewalled at every workstation?

I ask this question because I’ve read about how some of the services running in Windows XP and Windows 2000 can be a potential avenue of attack. Is port 3389 one of these when these services are enabled? And if so how do I protect them against intruders trying to gain access through them? TIA, Ken G.