TL;DR / Summary: A Windows VPS usually gives you two administrative RDP sessions, and they are for administration, not for hosting multiple users. If you need several concurrent desktops, you need a different licensing model, not a bigger plan.
Why the second session exists
Windows Server permits two simultaneous remote sessions for administrative purposes. The intent is that one administrator can work while another connects for maintenance.
It is not a provision for two employees to work all day on the same server. That distinction is in the licence terms, not in the remote desktop client, which is why it is so widely misunderstood.
Hosting an application, running a shared desktop, or giving each staff member a session requires Remote Desktop Services licensing on top of the Windows Server licence.
What happens at the limit
When both administrative sessions are in use, the third connection typically prompts to disconnect one of the existing sessions. Sometimes it fails outright.
This is most visible when a session was closed without logging off. The disconnected session stays active and consumes a slot, and the next person cannot get in.
Checks when a session is refused
- Disconnected sessions — sign out, do not just close the window
- Scheduled tasks — a script left in an interactive session holds a slot
- Console session — the hosting panel’s console may occupy a slot
- Group policy — session limits may be configured differently from the default
Most “RDP is broken” tickets are a disconnected session from three days ago.
Session timeouts and policy
Group policy can force disconnected sessions to end after a set time. On a shared server, that setting prevents slots being held indefinitely.
Set a disconnect timeout rather than an idle timeout. An idle timeout logs out someone who is reading a document; a disconnect timeout only cleans up abandoned sessions.
A session that is closed but not signed out is still a session you are paying for.
Document the policy in the handover notes. Administrators who do not know about it will keep reporting random lockouts.
Licensing models that fit
If several people need a desktop on the server, the correct model is Remote Desktop Services with per-user or per-device client access licences, plus a licence server.
That is a significant cost and a configuration project. For many small teams, a virtual desktop service or separate VPS instances per user is simpler and cheaper.
Compare the two honestly: one large server with RDS licensing against three small servers with two sessions each. The second option is often less work to operate.
Security around RDP
Open RDP to the internet attracts automated attacks within minutes. Restrict access by firewall to known addresses, or place the server behind a VPN.
Enable network level authentication, use strong passwords, and consider restricting the port through the provider’s firewall rather than the OS firewall.
Log successful and failed logons and review them weekly. A pattern of failures from one address is the early warning that the port is exposed.
Performance expectations
RDP session density depends on CPU and memory far more than on the network. Two administrators running browsers and tools can saturate a small plan.
Watch memory first. Windows itself consumes a baseline, and each session adds to it, so the practical limit arrives earlier than the spec suggests.
If sessions feel slow, check disk queue length before blaming bandwidth. Remote desktop is more sensitive to storage latency than to throughput.
For plans and session expectations, Windows VPS hosting sets out what the standard two-session model includes, which helps avoid buying a plan for a use case it does not cover. Confirm the licensing requirement before deployment, not after the first user complains.
Diagnosing a refused connection
Start with the session list, not the network. If two sessions exist and one is disconnected, that is your answer, and no firewall change will help.
Check the event log for logon failures. A failure with a licensing message points at a different problem than a failure with a credentials message.
Test from a second network if possible. A connection that fails everywhere is the server; one that fails from a single office is the firewall in front of it.
Most RDP tickets are a session nobody signed out of.
Document the diagnostic order on a shared note. The second person to hit the issue should not repeat the first person’s hour of investigation.
Train users to sign out rather than close the window. One sentence in the onboarding document prevents a recurring support load.
Alternatives to RDS licensing
For a handful of users, several small VPS instances are often cheaper than one server with client access licences.
Each user gets their own machine, their own session, and their own failure domain. The operational cost is higher; the licensing cost is zero.
One server with ten users is a single point of failure and a licensing project.
Compare the two totals over three years, including your own time. The answer is usually clearer than the marketing implies.
