How to Set Up RDP on Windows Server 2022: Step-by-Step

Remote Desktop (RDP) is how you will administer your Windows Server 2022 VPS, but unlike consumer Windows, a fresh Server 2022 installation arrives with Remote Desktop disabled. Enabling it takes two minutes; doing it securely takes a few more. This guide covers both: turning RDP on with Server Manager or PowerShell, opening the firewall, enforcing Network Level Authentication, granting users access, and hardening the setup so brute-force scanners do not own your server by Friday.

If you are setting this up on a new VPS, make sure the plan you chose actually fits the job — compare Windows VPS plans side by side to check CPU, RAM, and bandwidth before you deploy.

Step 1: Enable Remote Desktop

If your server runs the Desktop Experience edition, open Server Manager, click Local Server in the left pane, and next to Remote Desktop click Disabled, then Enable. That is the entire GUI path.

On Server Core, or if you prefer the command line, two commands do the same thing. The first allows remote connections by flipping the Terminal Server registry flag; the second opens the built-in firewall rule group:

Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections -Value 0
Enable-NetFirewallRule -DisplayGroup "Remote Desktop"

Step 2: Verify the Firewall Rules

Remote Desktop listens on TCP port 3389 by default, and the same port over UDP speeds up connection negotiation. Confirm both rules exist and are enabled:

Get-NetFirewallRule -DisplayGroup "Remote Desktop" | Select-Object DisplayName, Enabled, Direction

Remember that most VPS providers run a second, external firewall (a security group or the control panel’s firewall tool). RDP must be allowed there as well — a common failure is enabling everything inside Windows while the provider-level firewall still blocks port 3389.

Step 3: Keep Network Level Authentication On

Network Level Authentication (NLA) requires the user to authenticate before a full remote session is created, which reduces resource use and blocks several attack classes. It is enabled by default on Server 2022; verify it has not been turned off:

Get-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name UserAuthentication

If UserAuthentication is anything other than 1, set it back to 1 and reboot.

Step 4: Grant Users Access

Only members of the Remote Desktop Users group can log in (local Administrators are implicitly allowed). Add a user with one command:

net localgroup "Remote Desktop Users" CONTOSO\jdoe /add

Grant RDP access per user, not by dumping everyone into Administrators. A named admin account for your own daily work plus a locked-down built-in Administrator is a sensible baseline.

Step 5: Connect From Any OS

From Windows, the built-in client works: mstsc /v:203.0.113.10. From macOS and Linux, the Microsoft Remote Desktop client connects to the same server with the same credentials. Mobile clients from Microsoft’s App Store work for quick checks. On first connect you will see a certificate warning — expected, because the server uses a self-signed certificate — and you can accept it or replace it with a proper certificate later.

Step 6: Harden Before Exposing to the Internet

If RDP will be reachable from the public internet, treat hardening as mandatory:

• Enable account lockout — in secpol.msc → Account Lockout Policy, set 5 attempts and a 15-minute lockout. This single setting neutralizes most brute-force tools.
• Change the default port — edit the PortNumber value under HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp, restart the service, and update the firewall rule. Security by obscurity is not a strategy, but it cuts the automated scan noise dramatically.
• Restrict who can log in — keep the Remote Desktop Users group to named accounts, and consider IP allow-listing in the provider firewall if your users come from a fixed range.
• Add a second factor — services like Duo or Microsoft Entra ID can enforce MFA on RDP logons.
• Route through a gateway or VPN — for multiple users, Remote Desktop Gateway or a VPN is more manageable than exposing 3389 directly.

Troubleshooting Common Failures

• CredSSP error “the function requested is not supported” — an encryption-oracle mismatch between client and server. Update the client, or set HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters\AllowEncryptionOracle to 2 on the client as a short-term fix.
• “The remote session was disconnected” right after login — usually licensing. Windows Server allows two concurrent administrative RDP sessions without extra licenses; beyond that you need Remote Desktop Services CALs.
• Connection times out — check the provider-level firewall first, then the Windows firewall, then confirm the service is running (Get-Service TermService).
• NLA mismatch — older clients without NLA support fail against a server that requires it; keep NLA on and update the clients instead of weakening the server.

RDP on Server 2022 is straightforward once the pattern is familiar: enable, verify the firewall, keep NLA on, grant named users, harden before going public. Do the hardening steps up front and the daily reality is a stable remote session that never gets locked out by attackers. And when the time comes to scale, check out the best Windows VPS providers to find a plan with the specs your sessions actually need.