Remote Desktop (RDP) is how you administer a Windows VPS, and it is also the most attacked service on the public internet. Port 3389 is probed by automated scanners around the clock, which means how you enable and expose RDP decides \u2014 more than almost any other setting \u2014 whether your server gets compromised in its first week.<\/p>\n\n
If you have not provisioned a server yet, compare Windows VPS plans on our comparison table<\/a> first. Providers that give you a cloud-level firewall and let you change the RDP port from the control panel make the steps below much easier.<\/p>\n\n On Windows Server, open System Properties<\/strong> \u2192 Remote<\/strong> and select Allow remote connections to this computer<\/em>. Make sure the checkbox Allow connections only from computers running Remote Desktop with Network Level Authentication<\/em> is checked \u2014 NLA authenticates the user before a full session is created, which shuts down a whole class of pre-login attacks. The equivalent PowerShell:<\/p>\n\n The client you use does not change the server-side hardening. Windows ships with Automated scanners assume port 3389. Moving RDP to a high port removes most of that noise in one step. In The most effective control is restricting who can even reach the port. Use your provider’s cloud firewall if available; inside the OS, scope the RDP rule to your IP range:<\/p>\n\n If your IP changes frequently, connect through a VPN first and allow RDP only from the VPN subnet.<\/p>\n\n Without a lockout policy, an attacker can try passwords indefinitely. Set a moderate threshold from an elevated command prompt:<\/p>\n\n That locks an account for 30 minutes after 5 failed attempts within 30 minutes. Do not set the threshold to 1 \u2014 it makes it trivial for anyone to lock you out of your own server on purpose.<\/p>\n\n Two quick wins:<\/p>\n\n Also open Event ID 4625 records every failed logon. On a healthy server you should see very few; a flood means someone is targeting you:<\/p>\n\n Consistent failures from one IP are a strong signal to tighten your IP restriction or move RDP behind a VPN.<\/p>\n\n Periodically check who is logged in. The On a single-purpose VPS you should normally see exactly one interactive session \u2014 yours. A second session you did not start is a red flag worth investigating immediately.<\/p>\n\n If you administer several machines or work from many locations, exposing RDP directly on the internet is rarely the best design. A Windows VPN (built into Windows Server via the Routing and Remote Access role) or an RD Gateway in front of your VPS lets you close the RDP port entirely and authenticate at a separate layer. For a single VPS, IP restrictions plus NLA are usually sufficient; for a fleet, put RDP behind a gateway.<\/p>\n\nEnable RDP and Require Network Level Authentication<\/h2>\n\n
Set-ItemProperty -Path 'HKLM:\\System\\CurrentControlSet\\Control\\Terminal Server' -Name fDenyTSConnections -Value 0\nSet-ItemProperty -Path 'HKLM:\\System\\CurrentControlSet\\Control\\Terminal Server\\WinStations\\RDP-Tcp' -Name UserAuthentication -Value 1<\/code><\/pre>\n\nConnect from Windows, macOS, or Linux<\/h2>\n\n
mstsc.exe<\/code> (press Win+R, type mstsc<\/code>). macOS users install Microsoft Remote Desktop<\/strong> from the App Store, and Linux users can use Remmina<\/strong> or the FreeRDP<\/code> command-line client. Whichever you pick, always connect to the non-default port after changing it, for example mstsc \/v:203.0.113.10:53421<\/code>.<\/p>\n\nChange the RDP Port<\/h2>\n\n
regedit<\/code>, go to HKLM\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server\\WinStations\\RDP-Tcp<\/code>, edit the PortNumber<\/code> DWORD (default 3389) to something like 53421, and restart the server. Then update your firewall rules and connect with mstsc \/v:203.0.113.10:53421<\/code>. Note the trade-off: security through obscurity only helps against scanners, not targeted attackers, so keep the other controls in this article enabled regardless.<\/p>\n\nRestrict RDP by IP Address<\/h2>\n\n
New-NetFirewallRule -DisplayName \"RDP from office\" -Direction Inbound -Protocol TCP -LocalPort 53421 -RemoteAddress 203.0.113.0\/24 -Action Allow<\/code><\/pre>\n\nEnforce Account Lockout Policies<\/h2>\n\n
net accounts \/lockoutthreshold:5 \/lockoutduration:30 \/lockoutwindow:30<\/code><\/pre>\n\nDisable the Guest Account and Blank Passwords<\/h2>\n\n
net user guest \/active:no<\/code><\/pre>\n\nsecpol.msc<\/code> \u2192 Local Policies<\/strong> \u2192 Security Options<\/strong> and enable Accounts: Limit local account use of blank passwords to console logon only<\/em>. Blank or simple passwords on exposed accounts are how most VPS intrusions actually start.<\/p>\n\nWatch Failed Logons in the Security Log<\/h2>\n\n
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625} -MaxEvents 20 | Select-Object TimeCreated, @{n='SourceIP';e={$_.Properties[18].Value}}<\/code><\/pre>\n\nMonitor Active RDP Sessions<\/h2>\n\n
qwinsta<\/code> command lists every session on the server, and logoff<\/code> ends a specific session ID:<\/p>\n\nqwinsta\nlogoff 2<\/code><\/pre>\n\nConsider RDP over VPN or RD Gateway<\/h2>\n\n
RDP Security Checklist<\/h2>\n\n