Remote Desktop (RDP) is how you administer a Windows VPS, and it is also the most attacked service on the public internet. Port 3389 is probed by automated scanners around the clock, which means how you enable and expose RDP decides — more than almost any other setting — whether your server gets compromised in its first week.
If you have not provisioned a server yet, compare Windows VPS plans on our comparison table first. Providers that give you a cloud-level firewall and let you change the RDP port from the control panel make the steps below much easier.
Enable RDP and Require Network Level Authentication
On Windows Server, open System Properties → Remote and select Allow remote connections to this computer. Make sure the checkbox Allow connections only from computers running Remote Desktop with Network Level Authentication is checked — NLA authenticates the user before a full session is created, which shuts down a whole class of pre-login attacks. The equivalent PowerShell:
Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections -Value 0
Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name UserAuthentication -Value 1Connect from Windows, macOS, or Linux
The client you use does not change the server-side hardening. Windows ships with mstsc.exe (press Win+R, type mstsc). macOS users install Microsoft Remote Desktop from the App Store, and Linux users can use Remmina or the FreeRDP command-line client. Whichever you pick, always connect to the non-default port after changing it, for example mstsc /v:203.0.113.10:53421.
Change the RDP Port
Automated scanners assume port 3389. Moving RDP to a high port removes most of that noise in one step. In regedit, go to HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp, edit the PortNumber DWORD (default 3389) to something like 53421, and restart the server. Then update your firewall rules and connect with mstsc /v:203.0.113.10:53421. Note the trade-off: security through obscurity only helps against scanners, not targeted attackers, so keep the other controls in this article enabled regardless.
Restrict RDP by IP Address
The most effective control is restricting who can even reach the port. Use your provider’s cloud firewall if available; inside the OS, scope the RDP rule to your IP range:
New-NetFirewallRule -DisplayName "RDP from office" -Direction Inbound -Protocol TCP -LocalPort 53421 -RemoteAddress 203.0.113.0/24 -Action AllowIf your IP changes frequently, connect through a VPN first and allow RDP only from the VPN subnet.
Enforce Account Lockout Policies
Without a lockout policy, an attacker can try passwords indefinitely. Set a moderate threshold from an elevated command prompt:
net accounts /lockoutthreshold:5 /lockoutduration:30 /lockoutwindow:30That locks an account for 30 minutes after 5 failed attempts within 30 minutes. Do not set the threshold to 1 — it makes it trivial for anyone to lock you out of your own server on purpose.
Disable the Guest Account and Blank Passwords
Two quick wins:
net user guest /active:noAlso open secpol.msc → Local Policies → Security Options and enable Accounts: Limit local account use of blank passwords to console logon only. Blank or simple passwords on exposed accounts are how most VPS intrusions actually start.
Watch Failed Logons in the Security Log
Event ID 4625 records every failed logon. On a healthy server you should see very few; a flood means someone is targeting you:
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625} -MaxEvents 20 | Select-Object TimeCreated, @{n='SourceIP';e={$_.Properties[18].Value}}Consistent failures from one IP are a strong signal to tighten your IP restriction or move RDP behind a VPN.
Monitor Active RDP Sessions
Periodically check who is logged in. The qwinsta command lists every session on the server, and logoff ends a specific session ID:
qwinsta
logoff 2On a single-purpose VPS you should normally see exactly one interactive session — yours. A second session you did not start is a red flag worth investigating immediately.
Consider RDP over VPN or RD Gateway
If you administer several machines or work from many locations, exposing RDP directly on the internet is rarely the best design. A Windows VPN (built into Windows Server via the Routing and Remote Access role) or an RD Gateway in front of your VPS lets you close the RDP port entirely and authenticate at a separate layer. For a single VPS, IP restrictions plus NLA are usually sufficient; for a fleet, put RDP behind a gateway.
RDP Security Checklist
| Control | Recommended setting | Why it matters |
|---|---|---|
| Network Level Authentication | Enabled | Blocks pre-login attacks |
| RDP port | Non-default high port | Drops automated scanner noise |
| Source IP restriction | Your IP or VPN subnet | Only reachable by you |
| Lockout threshold | 5 attempts | Stops password guessing |
| Guest account | Disabled | Removes a default backdoor |
Conclusion
RDP is not the weak point of a Windows VPS — an exposed, unhardened RDP service is. Enable NLA, move the port, restrict the source IPs, and lock accounts after failed attempts. If you are setting up a new server, see the full Windows VPS specs on our comparison table and check which providers include cloud firewalls and console access for recovery. Contabo’s Windows VPS plans offer generous RAM and storage if you need room for multiple admin sessions and tooling.
