Remote Desktop (RDP) is how you administer a Windows Server, and it is also the most attacked service on the public internet. Port 3389 is probed by automated scanners around the clock, so the settings you choose while enabling RDP matter more than almost anything else on the box. This is a practical checklist: every item has a concrete setting, command, or policy value.<\/p>\n\n
On a full GUI install: Server Manager, Local Server, and toggle Remote Desktop to Enabled. On Server Core or from PowerShell, the equivalent is:<\/p>\n\n
Set-ItemProperty -Path 'HKLM:\\System\\CurrentControlSet\\Control\\Terminal Server' -Name fDenyTSConnections -Value 0\nEnable-NetFirewallRule -DisplayGroup 'Remote Desktop'<\/code><\/pre>\n\nOn Server Core you can also use sconfig and choose option 7 (Remote Desktop). Verify the firewall rule exists before you close your console session – the single most common way to lock yourself out is enabling RDP while the firewall still blocks it.<\/p>\n\n
Step 2 – Require Network Level Authentication (NLA)<\/h2>\n\n
NLA authenticates the user before a full remote session is created, which stops a large share of automated scanner traffic and resource-exhaustion attacks. In System Properties, Remote tab, choose Allow connections only from computers running Remote Desktop with Network Level Authentication. Programmatically:<\/p>\n\n
$ts = Get-WmiObject -Class Win32_TSGeneralSetting -Namespace root\\cimv2\\terminalservices -Filter \"TerminalName='RDP-tcp'\"\n$ts.UserAuthentication = 1\n$ts.SetUserAuthentication(1)<\/code><\/pre>\n\nStep 3 – Harden accounts<\/h2>\n\n- Create your own administrative account and use it; rename the built-in Administrator account and consider disabling it once your account is verified.<\/li>
- Enforce passwords of 14+ characters for any account allowed to log on remotely.<\/li>
- Set an account lockout policy. Five failed attempts followed by a 15-minute lockout is a reasonable starting point: net accounts \/lockoutthreshold:5 \/lockoutduration:15.<\/li>
- Trim the Remote Desktop Users group. Every member is an allowed login surface; keep it to the accounts that genuinely need interactive access.<\/li><\/ul>\n\n
Step 4 – Limit where connections can come from<\/h2>\n\n
The Remote Desktop Users group controls who; the Windows Firewall controls where. Scope the built-in RDP rule to your office or VPN address range instead of Any:<\/p>\n\n
Set-NetFirewallRule -DisplayGroup 'Remote Desktop' -RemoteAddress 203.0.113.0\/24<\/code><\/pre>\n\nChanging the RDP port from 3389 (registry value HKLM\\System\\CurrentControlSet\\Control\\Terminal Server\\WinStations\\RDP-Tcp, PortNumber, plus a matching firewall rule) is optional. It is not real security – a port scan finds it – but it does cut the noise from scanners that only check 3389. Treat it as a convenience, not a control.<\/p>\n\n
Step 5 – Replace the self-signed certificate<\/h2>\n\n
Out of the box, RDP presents a self-signed certificate, which produces client warnings and offers no identity guarantee. Issue a proper certificate (internal CA for a domain, or a publicly trusted certificate with the server FQDN) and place it in the Computer account, Remote Desktop\\Certificates store. Clients then connect without warnings and you can actually verify you are talking to your server.<\/p>\n\n
Step 6 – Watch the logs<\/h2>\n\n
RDP attacks leave traces. The Security log events that matter: 4624 (successful logon), 4625 (failed logon), and 4776 (credential validation). The TerminalServices-RemoteConnectionManager operational log records RDP connection attempts specifically. A quick look at recent failures:<\/p>\n\n
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625} -MaxEvents 20 |\n Select-Object TimeCreated, @{n='SourceIP';e={$_.Properties[18].Value}}<\/code><\/pre>\n\nA steady stream of 4625 events from one source means you are being targeted; combine the lockout policy, IP scoping, and the failed-logon audit to respond.<\/p>\n\n
Step 7 – Add a second factor or a gateway<\/h2>\n\n
Once the basics are solid, the next layer is authentication beyond the password. RDP itself has no native MFA, but RADIUS-based solutions work cleanly: the Network Policy Server (NPS) role can forward RDP authentication to Azure AD MFA or a third-party RADIUS provider, and the Remote Desktop client then prompts for the second factor at logon. That single change eliminates credential-stuffing risk even if a password leaks.<\/p>\n\n
If multiple users need access from arbitrary locations, consider Remote Desktop Gateway instead of exposing 3389 further. RD Gateway publishes a single HTTPS endpoint (port 443) and tunnels RDP inside TLS, so the only open port is the one a web server would use. It adds setup complexity, but it removes the exposed RDP listener entirely. For a single-admin server, IP-scoped firewall rules plus MFA are usually sufficient and much simpler to maintain.<\/p>\n\n
- Single admin, fixed location: firewall IP scoping + NLA + lockout policy.<\/li>
- Multiple admins, varied locations: RD Gateway or VPN, plus MFA via NPS\/RADIUS.<\/li>
- Anything internet-facing: never leave RDP open to 0.0.0.0\/0 without at least NLA and lockout configured.<\/li><\/ul>\n\n
Checklist summary<\/h2>\n\nItem<\/th> Default<\/th> Recommended<\/th><\/tr><\/thead> NLA<\/td> Varies by image<\/td> Enabled (UserAuthentication=1)<\/td><\/tr> Built-in Administrator<\/td> Enabled<\/td> Renamed, replaced by a named admin account<\/td><\/tr> Password length<\/td> Policy-dependent<\/td> 14+ characters<\/td><\/tr> Account lockout<\/td> 0 (never locks)<\/td> 5 attempts \/ 15-minute lockout<\/td><\/tr> Remote Desktop Users<\/td> Administrators<\/td> Minimal named accounts only<\/td><\/tr> RDP port<\/td> 3389<\/td> 3389, or non-standard + IP-scoped firewall<\/td><\/tr> RDP certificate<\/td> Self-signed<\/td> CA-issued, matching the hostname<\/td><\/tr><\/tbody><\/table><\/figure>\n\nIf you are choosing a host, compare Windows VPS plans on our table<\/a> – providers that give you console access and pre-configured firewall images make these steps far less risky. Our main comparison<\/a> also notes which Windows Server VPS providers include RDP hardening guidance in their docs.<\/p>\n\nRDP setup takes ten minutes; RDP security is a checklist you revisit. Enable NLA, lock the accounts, scope the firewall, fix the certificate, and read the logs – that combination stops the overwhelming majority of brute-force attempts.<\/p>\n\n