How to Set Up Remote Desktop (RDP) on a Windows VPS Step by Step

Remote Desktop (RDP) is the standard way to manage a Windows VPS: it gives you a full desktop session over the network, so you can use Server Manager, install software, and run IIS Manager as if you were sitting at the console. The setup itself is only a few clicks, but doing it correctly — enabling the service, opening the firewall port, and hardening the endpoint — is what separates a usable server from one that gets brute-forced within hours of going live. This guide covers the complete setup plus the security settings that should be non-negotiable.

Prerequisites

• A Windows Server VPS (2022 or 2025) with a public IPv4 address.
• Administrator credentials from your provider’s control panel.
• A client machine with the Remote Desktop client (mstsc.exe on Windows, Microsoft Remote Desktop on macOS).

Step 1: Enable Remote Desktop

On a freshly provisioned server RDP is usually already enabled, but verify it in Server Manager: click Local Server and check the Remote Desktop field. If it says Disabled, click it, select Allow remote connections to this computer, and keep Network Level Authentication enabled (it is on by default).

Prefer automation? Enable it from an elevated PowerShell session:

Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections -Value 0
Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name UserAuthentication -Value 1
Enable-NetFirewallRule -DisplayGroup 'Remote Desktop'

Step 2: Open Port 3389 in Windows Firewall

Windows Firewall blocks inbound RDP by default on some images. The Enable-NetFirewallRule line above enables the built-in “Remote Desktop” rules, but if you replaced the default firewall profile, add the rule explicitly:

New-NetFirewallRule -DisplayName 'RDP 3389' -Direction Inbound -Protocol TCP -LocalPort 3389 -Action Allow

Then confirm the listener is active: netstat -an | findstr 3389 should show LISTENING. Remember that the cloud provider’s own security group or firewall may also filter port 3389 — if the connection times out from outside, check the provider panel, not just the OS firewall. Providers differ a lot in firewall controls, so compare Windows VPS plans on our comparison table to see which panels support source-IP rules.

Step 3: Connect With mstsc

On Windows, press Win+R, type mstsc, and enter the server’s IP address. Save the connection as a .rdp file so you do not retype it. Before connecting, open the Experience tab and match the connection speed to your link — this controls desktop wallpaper, font smoothing, and other bandwidth-heavy features.

If the connection fails with “This computer can’t connect to the remote computer”, work through the checklist in order: is the service running (Get-Service TermService), is the port listening, is the firewall rule active, and is the provider security group allowing TCP 3389?

Step 4: Harden RDP Before Exposing It to the Internet

A server with RDP open to the whole internet attracts brute-force attempts within hours — check the Security event log and you will see failed logon attempts from random IPs. The following settings cut that down dramatically:

• Change the default port: edit HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp, set PortNumber to something like 53389 (decimal), restart the service, and open the new port in the firewall. This stops the automated scanners that only probe 3389.
• Enforce account lockout: in gpedit.msc go to Computer Configuration > Windows Settings > Security Settings > Account Policies > Account Lockout Policy and set a threshold of 5 failed attempts with a 15-minute lockout.
• Restrict RDP to a security group: in the same policy tree, set “Allow log on through Remote Desktop Services” to include only Administrators.
• Rename the Administrator account or create a separate admin user with a passphrase of 20+ characters.

Step 5: Restart and Verify

After changing the port, restart Remote Desktop Services or reboot the server, then verify the new port is listening: netstat -an | findstr 53389. From your client, connect using IP:53389 in mstsc. Re-test the old port — it should now be closed from the outside, which you can confirm with Test-NetConnection <server-ip> -Port 3389 from your local machine.

Setting	Default	Recommended
RDP port	3389	Non-standard (e.g., 53389)
Network Level Authentication	Enabled	Keep enabled
Account lockout threshold	None	5 attempts / 15 minutes
RDP access group	Everyone	Administrators only
Firewall source restriction	All IPs	Your office IP range if possible

If the provider panel supports it, add a firewall rule that allows RDP only from your office IP range. Combined with the account lockout policy, this is the single most effective protection. For providers without panel-level rules, the OS firewall with a source-IP restriction works just as well:

Remove-NetFirewallRule -DisplayName 'RDP 3389'
New-NetFirewallRule -DisplayName 'RDP 53389' -Direction Inbound -Protocol TCP -LocalPort 53389 -RemoteAddress 203.0.113.10 -Action Allow

Once RDP is up and hardened, you can move on to installing roles — IIS, SQL Server, or your .NET apps. For a quick reference on the specs you should be buying, see the full specs and pricing on our Windows VPS comparison table.

Vultr provisions Windows Server instances in under a minute and gives you full control over firewall rules and snapshots, which makes RDP hardening straightforward. Get started with Vultr Windows VPS.

Troubleshooting Common RDP Problems

• Connection times out: the provider security group is blocking 3389 — allow the port in the panel.
• “Your credentials did not work” or login loop: you may be connecting to a domain-joined machine or the account is locked — use SERVERNAME\Administrator as the username.
• Black screen after login: often a display/driver issue in the RDP session — disconnect and reconnect, or disable hardware acceleration in the client.
• “No Remote Desktop licenses available” warning: normal for the built-in two administrative sessions; ignore it unless you need more concurrent users, which requires the Remote Desktop Services role and CALs.

That is the full setup: enable RDP, open the port, connect, harden, and verify. The whole process takes under 10 minutes, and the hardening steps are what keep your server usable for years instead of compromised in days.