RDP Hardening Checklist for Windows Server 2022 on a VPS

An RDP-exposed Windows Server 2022 VPS is one of the most relentlessly attacked services on the internet. Bots scan port 3389 within minutes of a host coming online, and credential-stuffing attempts never stop. This checklist is the hardening pass you should run on every new build — it covers network exposure, authentication, account lockout, certificates and the session-level settings that stop an exposed RDP listener from becoming an incident.

Harden the host, but also pick a host whose default network model supports what you need. Our Windows VPS provider comparison shows which plans give you a private firewall and static IP so you can lock down 3389 without fighting a shared NAT.

1. Don’t Expose 3389 to the Whole Internet

• Best: put RDP behind a VPN (OpenVPN/WireGuard on the VPS) and bind the listener to the VPN subnet only.
• Second best: restrict 3389 with the host firewall to your office/home egress IPs.
• Change the listening port only as defense-in-depth — it is not security on its own.

Scope the firewall rule over PowerShell:

Set-NetFirewallRule -DisplayGroup 'Remote Desktop' -RemoteAddress 203.0.113.10,198.51.100.0/24

Then confirm nothing else is open: Get-NetFirewallRule -Enabled True -Direction Inbound | Get-NetFirewallPortFilter.

2. Enforce Network Level Authentication (NLA)

NLA forces authentication before a session is created, which blocks the pre-auth resource exhaustion that plagues classic RDP. Verify it:

Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' | Select UserAuthentication,SecurityLayer,MinEncryptionLevel

Expected: UserAuthentication = 1, SecurityLayer = 2 (TLS), MinEncryptionLevel = 3 (High). Set them with Set-ItemProperty and restart TermService.

3. Account Lockout and Admin Hygiene

• Rename the built-in Administrator account; disable it entirely if you use a named admin.
• Configure account lockout via secpol.msc or GPO: lockout threshold 5–10 attempts, duration 15 minutes, reset counter 15 minutes.
• Consider Remote Credential Guard or Restricted Admin mode so credentials are never cached on the session host.

4. TLS Certificate and Listener Settings

Bind a proper certificate to the RDP listener so clients see a valid identity rather than a self-signed warning (users who click through warnings train themselves to ignore MITM). Assign the cert thumbprint:

wmic /namespace:\\root\cimv2\terminalservices path Win32_TSGeneralSetting set SSLCertificateSHA1Hash="<THUMBPRINT>"

5. Session Limits and Idle Timeouts

Limit idle sessions so abandoned connections don’t hold licenses or resources:

• Set time limit for active but idle Remote Desktop Services sessions → 15 minutes.
• Set time limit for disconnected sessions → 1 minute (or terminate disconnected sessions entirely).
• End sessions from the server: qwinsta to list, logoff <ID> to terminate.

Control	Where	Target
Port exposure	Firewall / VPN	IP-scoped
NLA	RDP-Tcp registry	Enabled
Encryption	RDP-Tcp registry	High (3)
Lockout	secpol.msc	5 attempts
Idle timeout	GPO	15 min

6. Audit and Alert

Turn on logon auditing and watch for failed type-3/type-10 logons:

• Enable Audit Logon (success and failure) under Advanced Audit Policy.
• Hunt failures: Get-WinEvent -LogName Security | Where-Object { $_.Id -eq 4625 }.
• Watch for Event ID 4625 spikes — a steady stream means a brute-force campaign and your IP allowlist is doing its job.

Work through this list top to bottom on every new VPS. If you are still selecting a host, review the main site for providers that expose firewall and snapshot controls. And if you want a quick, RDP-ready Windows box to harden, InterServer Windows VPS is a practical option (promo code TRYINTERSERVER).

Exposure control plus NLA plus lockout plus audit covers the vast majority of real-world RDP attacks. Do those four and the rest of the list becomes incremental hardening rather than damage control.