Remote Desktop (RDP) is how you will administer your Windows Server 2022 VPS, but unlike consumer Windows, a fresh Server 2022 installation arrives with Remote Desktop disabled. Enabling it takes two minutes; doing it securely takes a few more. This guide covers both: turning RDP on with Server Manager or PowerShell, opening the firewall, enforcing Network Level Authentication, granting users access, and hardening the setup so brute-force scanners do not own your server by Friday.<\/p>\n\n
If you are setting this up on a new VPS, make sure the plan you chose actually fits the job \u2014 compare Windows VPS plans side by side<\/a> to check CPU, RAM, and bandwidth before you deploy.<\/p>\n\n If your server runs the Desktop Experience edition, open Server Manager, click Local Server<\/strong> in the left pane, and next to Remote Desktop<\/strong> click Disabled<\/strong>, then Enable<\/strong>. That is the entire GUI path.<\/p>\n\n On Server Core, or if you prefer the command line, two commands do the same thing. The first allows remote connections by flipping the Terminal Server registry flag; the second opens the built-in firewall rule group:<\/p>\n\n Remote Desktop listens on TCP port 3389 by default, and the same port over UDP speeds up connection negotiation. Confirm both rules exist and are enabled:<\/p>\n\n Remember that most VPS providers run a second, external firewall (a security group or the control panel’s firewall tool). RDP must be allowed there as well \u2014 a common failure is enabling everything inside Windows while the provider-level firewall still blocks port 3389.<\/p>\n\n Network Level Authentication (NLA) requires the user to authenticate before a full remote session is created, which reduces resource use and blocks several attack classes. It is enabled by default on Server 2022; verify it has not been turned off:<\/p>\n\n If Only members of the Remote Desktop Users<\/strong> group can log in (local Administrators are implicitly allowed). Add a user with one command:<\/p>\n\n Grant RDP access per user, not by dumping everyone into Administrators. A named admin account for your own daily work plus a locked-down built-in Administrator is a sensible baseline.<\/p>\n\n From Windows, the built-in client works: If RDP will be reachable from the public internet, treat hardening as mandatory:<\/p>\n\n RDP on Server 2022 is straightforward once the pattern is familiar: enable, verify the firewall, keep NLA on, grant named users, harden before going public. Do the hardening steps up front and the daily reality is a stable remote session that never gets locked out by attackers. And when the time comes to scale, check out the best Windows VPS providers<\/a> to find a plan with the specs your sessions actually need.<\/p>","protected":false},"excerpt":{"rendered":"Step 1: Enable Remote Desktop<\/h2>\n\n
Set-ItemProperty -Path 'HKLM:\\System\\CurrentControlSet\\Control\\Terminal Server' -Name fDenyTSConnections -Value 0\nEnable-NetFirewallRule -DisplayGroup \"Remote Desktop\"<\/code><\/pre>\n\nStep 2: Verify the Firewall Rules<\/h2>\n\n
Get-NetFirewallRule -DisplayGroup \"Remote Desktop\" | Select-Object DisplayName, Enabled, Direction<\/code><\/pre>\n\nStep 3: Keep Network Level Authentication On<\/h2>\n\n
Get-ItemProperty -Path 'HKLM:\\System\\CurrentControlSet\\Control\\Terminal Server\\WinStations\\RDP-Tcp' -Name UserAuthentication<\/code><\/pre>\n\nUserAuthentication<\/code> is anything other than 1, set it back to 1 and reboot.<\/p>\n\nStep 4: Grant Users Access<\/h2>\n\n
net localgroup \"Remote Desktop Users\" CONTOSO\\jdoe \/add<\/code><\/pre>\n\nStep 5: Connect From Any OS<\/h2>\n\n
mstsc \/v:203.0.113.10<\/code>. From macOS and Linux, the Microsoft Remote Desktop client connects to the same server with the same credentials. Mobile clients from Microsoft’s App Store work for quick checks. On first connect you will see a certificate warning \u2014 expected, because the server uses a self-signed certificate \u2014 and you can accept it or replace it with a proper certificate later.<\/p>\n\nStep 6: Harden Before Exposing to the Internet<\/h2>\n\n
secpol.msc<\/code> \u2192 Account Lockout Policy, set 5 attempts and a 15-minute lockout. This single setting neutralizes most brute-force tools.<\/li>PortNumber<\/code> value under HKLM\\System\\CurrentControlSet\\Control\\Terminal Server\\WinStations\\RDP-Tcp<\/code>, restart the service, and update the firewall rule. Security by obscurity is not a strategy, but it cuts the automated scan noise dramatically.<\/li>Troubleshooting Common Failures<\/h2>\n\n
HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\CredSSP\\Parameters\\AllowEncryptionOracle<\/code> to 2 on the client as a short-term fix.<\/li>Get-Service TermService<\/code>).<\/li>