Remote Desktop is the primary way to access a Windows VPS. Whether you are deploying a .NET application, configuring IIS, or running a SQL Server database, the first thing you need after provisioning the server is a working RDP connection. This guide covers the entire setup: enabling RDP on the server, configuring the firewall, connecting from Windows and macOS, and the security settings that keep the connection safe. If you are still choosing a provider, our Windows VPS comparison table lists which providers include RDP access and firewall controls in their base plans.
Step 1: Enable Remote Desktop on the Server
Most Windows VPS images come with Remote Desktop enabled by default, but if yours does not (or if you are rebuilding from a template), enable it through Server Manager or PowerShell:
# Enable RDP via PowerShell
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server" -Name "fDenyTSConnections" -Value 0
# Enable the firewall rule for RDP
Enable-NetFirewallRule -DisplayGroup "Remote Desktop"Alternatively, open Server Manager → Local Server and click the Remote Desktop toggle to enable it. Either method produces the same result.
Step 2: Verify the Firewall Rule for Port 3389
RDP uses TCP port 3389 by default. The Windows Firewall rule for Remote Desktop is created automatically when you enable RDP, but verify it is present and active:
# Check if the RDP firewall rule exists and is enabled
Get-NetFirewallRule -DisplayGroup "Remote Desktop" | Format-Table Name, Enabled, Direction, ActionYou should see two rules: one for TCP inbound on port 3389 and one for UDP inbound. If the rules are missing, create them manually:
# Create the RDP firewall rule manually
New-NetFirewallRule -DisplayName "Remote Desktop (TCP-In)" `
-Direction Inbound -Protocol TCP -LocalPort 3389 -Action AllowIf your VPS is behind a cloud provider’s security group or firewall (AWS Security Group, Azure NSG, etc.), also open port 3389 at that layer. The Windows firewall and the provider firewall are separate — both must allow the traffic.
Step 3: Connect from Windows (Built-In RDP Client)
Windows includes the Remote Desktop Connection (MSTSC) client. Press Win + R, type mstsc, and press Enter. Enter your server’s IP address or hostname and click Connect. When prompted, enter the Administrator username and password provided by your VPS host.
For a smoother experience, save the connection as an .rdp file. Click Show Options, set the display resolution, check Allow my saved credentials, and click Save As. This saves the server address and display settings so you can connect with a single double-click next time.
Step 4: Connect from macOS (Microsoft Remote Desktop)
Microsoft provides the Microsoft Remote Desktop client for macOS in the Mac App Store. After installing it:
- Click Add PC and enter your server’s IP address or hostname.
- Under User Account, select Add User Account and enter
Administratorand the password. - Optionally set a Friendly Name for the connection (e.g., “Production Web Server”).
- Click Add, then double-click the connection to start the session.
The macOS client supports the same features as the Windows version: display scaling, clipboard sharing, and printer redirection. If you experience lag, reduce the display resolution or disable the background in the session settings.
Step 5: Connect from Linux (FreeRDP or Remmina)
Linux users can connect via Remmina (GUI) or FreeRDP (CLI). Install either:
# Ubuntu/Debian
sudo apt install remmina freerdp2-x11
# Connect via FreeRDP
xfreerdp /v:your-server-ip /u:Administrator /cert-ignoreRemmina provides a tabbed interface for managing multiple RDP connections. Add your server’s IP, username, and password, and save the profile for quick access.
Step 6: Secure the RDP Connection
Security is not optional when RDP is exposed to the internet. Three settings make the most impact:
Enable Network Level Authentication (NLA)
NLA requires the client to authenticate before a full RDP session is created. This blocks pre-auth attack vectors like the BlueKeep vulnerability. Verify it is enabled:
# Check NLA status
Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" |
Select-Object UserAuthentication, SecurityLayer
# UserAuthentication should be 1, SecurityLayer should be 2 (TLS)Use Strong Passwords
A weak password is the most common RDP breach vector. The Administrator account password should be at least 16 characters with a mix of upper case, lower case, digits, and symbols. Consider using a password manager to generate and store it.
Change the Default RDP Port
Changing port 3389 to a non-standard port eliminates automated scanner noise. While it does not stop a determined attacker, it reduces daily failed login attempts from thousands to near zero:
# Change RDP port to 3390
Set-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" -Name PortNumber -Value 3390
# Add a firewall rule for the new port
New-NetFirewallRule -DisplayName "RDP - Custom Port 3390" `
-Direction Inbound -Protocol TCP -LocalPort 3390 -Action Allow
# Restart the RDP service
Restart-Service TermService -ForceAfter changing the port, connect using your-server-ip:3390 in the RDP client.
Step 7: Troubleshooting Common RDP Issues
| Problem | Likely Cause | Fix |
|---|---|---|
| Connection timed out | Port 3389 blocked by firewall or security group | Check cloud provider firewall settings and Windows Firewall rules |
| “This computer can’t connect to the remote computer” | Server is not reachable or RDP is disabled | Verify the server is running and RDP is enabled via the registry check above |
| “Your credentials did not work” | Wrong username or password | Use the correct format: .\Administrator or SERVERNAME\Administrator |
| “The remote session was disconnected” | Another user was logged in (Windows limits concurrent RDP sessions) | Use qwinsta on the server to see active sessions, then rwinsta <sessionid> to disconnect stale ones |
| NLA error on older clients | Client does not support NLA | Update the RDP client to at least Windows 8 / macOS 10.12, or temporarily disable NLA (not recommended) |
| Black screen after connecting | Display driver issue or session timeout | Press Ctrl+Alt+End (Windows) or Ctrl+Shift+End (macOS) to trigger the security screen |
Recommended RDP Security Baseline
Apply these settings to every new Windows VPS before you start working:
- Enable NLA (verify
UserAuthentication= 1) - Set account lockout threshold to 5 attempts
- Rename the built-in Administrator account
- Restrict firewall access to your office IP or VPN subnet
- Change the default port from 3389
- Use a 16+ character password
For extra protection, route RDP through a VPN or RD Gateway instead of exposing it directly. This hides the RDP port entirely and is the single strongest security measure you can take. For more RDP security details, see our article on RDP NLA, certificates, and account lockout. And if you are still planning your hosting setup, compare Windows VPS plans to find a provider that suits your needs.
