How to Set Up Remote Desktop (RDP) Securely on Windows Server

Remote Desktop Protocol (RDP) is the primary way administrators connect to Windows Server. Out of the box, RDP is functional but not hardened — it listens on port 3389, accepts password authentication, and trusts the default self-signed certificate. This guide walks through a complete RDP setup on Windows Server 2022 and 2025, with security configurations that block the most common attack vectors while keeping remote access reliable.

Initial RDP Enablement

RDP is disabled by default on Windows Server. Enable it via PowerShell:

Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name "fDenyTSConnections" -Value 0
Enable-NetFirewallRule -DisplayGroup "Remote Desktop"

This enables RDP and opens the firewall port. By default, only members of the local Administrators group can connect. Add specific users with Add-LocalGroupMember -Group "Remote Desktop Users" -Member "username" to grant RDP access without granting full administrator privileges.

Network Level Authentication (NLA)

NLA requires the client to authenticate before establishing a full RDP session. This prevents resource exhaustion attacks and reduces the attack surface. NLA is enabled by default on Windows Server 2022 and later, but verify the setting:

Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name UserAuthentication

A value of 1 means NLA is required. If it is 0, set it with Set-ItemProperty. NLA must be supported by the client — Windows 10/11, Windows Server 2012+, and the latest macOS Remote Desktop client all support it.

Configuring RDP with a Proper TLS Certificate

The default self-signed certificate used by RDP triggers a warning on every connection. For production environments, bind a trusted SSL certificate to the RDP listener:

• Obtain a certificate from a public CA (Let’s Encrypt, DigiCert, etc.) or your internal PKI with the server’s FQDN in the subject or SAN.
• Ensure the certificate has the Server Authentication (1.3.6.1.5.5.7.3.1) extended key usage.
• Store the certificate in the local machine’s Personal certificate store.
• Use the certificate’s thumbprint to bind it to the RDP service.

After setting the certificate, restart the Terminal Services service: Restart-Service TermService -Force.

Account Lockout Policies to Stop Brute Force

RDP is a common target for brute-force attacks. Configure account lockout policies via Local Security Policy:

Policy	Recommended Setting
Account lockout threshold	10 invalid logon attempts
Account lockout duration	30 minutes
Reset account lockout counter after	30 minutes

Set these via PowerShell:

net accounts /lockoutthreshold:10 /lockoutduration:30 /lockoutwindow:30

This prevents attackers from trying thousands of passwords. Combined with NLA, the lockout is enforced before the RDP session is established.

Changing the Default RDP Port

Changing the RDP port from 3389 to a non-standard port reduces automated scanning noise. While this is not a security measure against a determined attacker, it eliminates the constant background noise from port scanners:

Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name PortNumber -Value 3390
Restart-Service TermService -Force
New-NetFirewallRule -DisplayName "RDP-3390" -Direction Inbound -Protocol TCP -LocalPort 3390 -Action Allow

Remove the old firewall rule for port 3389 and replace it with a custom rule for your new port. Remember to update your firewall rules at the provider level as well.

RDP Session Timeout and Idle Limits

Disconnected RDP sessions accumulate and consume server resources. Set idle timeouts and automatic disconnection:

Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name MaxIdleTime -Value 600000
Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name MaxDisconnectionTime -Value 300000

These settings log off idle sessions after 10 minutes of inactivity and terminate disconnected sessions after 5 minutes, freeing up license and memory resources.

Restricting RDP Access by IP Address

For servers with a fixed set of administrators, restrict RDP access to specific IP addresses using Windows Defender Firewall with Advanced Security:

$rule = Get-NetFirewallRule -DisplayGroup "Remote Desktop"
$rule | Set-NetFirewallRule -RemoteAddress "203.0.113.0/24","198.51.100.0/24"

This is one of the most effective RDP hardening measures. Even a brute-force attack against a strong password fails if the attacker’s IP address is not in the allowed range.

Auditing RDP Logins

Enable audit logging for logon events to track RDP access:

auditpol /set /subcategory:"Logon" /success:enable /failure:enable

Monitor Event ID 4624 (successful logon) and 4625 (failed logon) from the Security event log. A sudden spike in 4625 events from the same source IP is a strong indicator of a brute-force attack in progress.

Summary

A secure RDP setup on Windows Server requires more than just enabling Remote Desktop. NLA, proper TLS certificates, account lockout policies, IP address restrictions, and session timeouts work together to create a layered defense. Start with NLA and account lockout (they stop the most common attacks), then add certificate binding and IP restrictions for stronger protection. For hosting providers that offer managed RDP access, compare Windows VPS plans on our comparison table to find a configuration that balances security and accessibility for your team.