{"id":555,"date":"2026-08-06T22:57:02","date_gmt":"2026-08-06T22:57:02","guid":{"rendered":"https:\/\/windows-vps.org\/blog\/?p=555"},"modified":"2026-10-04T22:05:03","modified_gmt":"2026-10-04T22:05:03","slug":"setup-rdp-windows-server-2022","status":"publish","type":"post","link":"https:\/\/windows-vps.org\/blog\/setup-rdp-windows-server-2022\/","title":{"rendered":"RDP Hardening Checklist for Windows Server 2022 on a VPS"},"content":{"rendered":"<div style=\"padding:20px\">\n\n\n<p class=\"wp-block-paragraph\">An RDP-exposed Windows Server 2022 VPS is one of the most relentlessly attacked services on the internet. Bots scan port 3389 within minutes of a host coming online, and credential-stuffing attempts never stop. This checklist is the hardening pass you should run on every new build \u2014 it covers network exposure, authentication, account lockout, certificates and the session-level settings that stop an exposed RDP listener from becoming an incident.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Harden the host, but also pick a host whose default network model supports what you need. Our <a href=\"https:\/\/windows-vps.org\/#providers\">Windows VPS provider comparison<\/a> shows which plans give you a private firewall and static IP so you can lock down 3389 without fighting a shared NAT.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">1. Don&#8217;t Expose 3389 to the Whole Internet<\/h2>\n\n\n\n<ul class=\"wp-block-list\"><li>Best: put RDP behind a VPN (OpenVPN\/WireGuard on the VPS) and bind the listener to the VPN subnet only.<\/li><li>Second best: restrict 3389 with the host firewall to your office\/home egress IPs.<\/li><li>Change the listening port only as defense-in-depth \u2014 it is not security on its own.<\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Scope the firewall rule over PowerShell:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><code>Set-NetFirewallRule -DisplayGroup 'Remote Desktop' -RemoteAddress 203.0.113.10,198.51.100.0\/24<\/code><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Then confirm nothing else is open: <code>Get-NetFirewallRule -Enabled True -Direction Inbound | Get-NetFirewallPortFilter<\/code>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">2. Enforce Network Level Authentication (NLA)<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">NLA forces authentication before a session is created, which blocks the pre-auth resource exhaustion that plagues classic RDP. Verify it:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><code>Get-ItemProperty 'HKLM:\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server\\WinStations\\RDP-Tcp' | Select UserAuthentication,SecurityLayer,MinEncryptionLevel<\/code><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Expected: <code>UserAuthentication = 1<\/code>, <code>SecurityLayer = 2<\/code> (TLS), <code>MinEncryptionLevel = 3<\/code> (High). Set them with <code>Set-ItemProperty<\/code> and restart <code>TermService<\/code>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">3. Account Lockout and Admin Hygiene<\/h2>\n\n\n\n<ul class=\"wp-block-list\"><li>Rename the built-in Administrator account; disable it entirely if you use a named admin.<\/li><li>Configure account lockout via <code>secpol.msc<\/code> or GPO: lockout threshold 5\u201310 attempts, duration 15 minutes, reset counter 15 minutes.<\/li><li>Consider <strong>Remote Credential Guard<\/strong> or <strong>Restricted Admin mode<\/strong> so credentials are never cached on the session host.<\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">4. TLS Certificate and Listener Settings<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Bind a proper certificate to the RDP listener so clients see a valid identity rather than a self-signed warning (users who click through warnings train themselves to ignore MITM). Assign the cert thumbprint:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><code>wmic \/namespace:\\\\root\\cimv2\\terminalservices path Win32_TSGeneralSetting set SSLCertificateSHA1Hash=\"&lt;THUMBPRINT&gt;\"<\/code><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">5. Session Limits and Idle Timeouts<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Limit idle sessions so abandoned connections don&#8217;t hold licenses or resources:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>Set time limit for active but idle Remote Desktop Services sessions<\/strong> \u2192 15 minutes.<\/li><li><strong>Set time limit for disconnected sessions<\/strong> \u2192 1 minute (or terminate disconnected sessions entirely).<\/li><li>End sessions from the server: <code>qwinsta<\/code> to list, <code>logoff &lt;ID&gt;<\/code> to terminate.<\/li><\/ul>\n\n\n\n<figure class=\"wp-block-table\"><table><thead><tr><th>Control<\/th><th>Where<\/th><th>Target<\/th><\/tr><\/thead><tbody><tr><td>Port exposure<\/td><td>Firewall \/ VPN<\/td><td>IP-scoped<\/td><\/tr><tr><td>NLA<\/td><td>RDP-Tcp registry<\/td><td>Enabled<\/td><\/tr><tr><td>Encryption<\/td><td>RDP-Tcp registry<\/td><td>High (3)<\/td><\/tr><tr><td>Lockout<\/td><td>secpol.msc<\/td><td>5 attempts<\/td><\/tr><tr><td>Idle timeout<\/td><td>GPO<\/td><td>15 min<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">6. Audit and Alert<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Turn on logon auditing and watch for failed type-3\/type-10 logons:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Enable <em>Audit Logon<\/em> (success and failure) under Advanced Audit Policy.<\/li><li>Hunt failures: <code>Get-WinEvent -LogName Security | Where-Object { $_.Id -eq 4625 }<\/code>.<\/li><li>Watch for Event ID 4625 spikes \u2014 a steady stream means a brute-force campaign and your IP allowlist is doing its job.<\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Work through this list top to bottom on every new VPS. If you are still selecting a host, review the <a href=\"https:\/\/windows-vps.org\/\">main site<\/a> for providers that expose firewall and snapshot controls. And if you want a quick, RDP-ready Windows box to harden, <a href=\"https:\/\/interserver.net\/r\/1067805?url=interserver.net\/vps\/windows-vps.html\" rel=\"noreferrer noopener sponsored\" target=\"_blank\">InterServer Windows VPS<\/a> is a practical option (promo code <strong>TRYINTERSERVER<\/strong>).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Exposure control plus NLA plus lockout plus audit covers the vast majority of real-world RDP attacks. Do those four and the rest of the list becomes incremental hardening rather than damage control.<\/p>\n\n\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>An RDP-exposed Windows Server 2022 VPS is one of the most relentlessly attacked services on the internet. Bots scan port 3389 within minutes of a host coming online, and credential-stuffing attempts never stop. This checklist is the hardening pass you should run on every new build \u2014 it covers network exposure, authentication, account lockout, certificates &#8230; <a title=\"RDP Hardening Checklist for Windows Server 2022 on a VPS\" class=\"read-more\" href=\"https:\/\/windows-vps.org\/blog\/setup-rdp-windows-server-2022\/\" aria-label=\"Read more about RDP Hardening Checklist for Windows Server 2022 on a VPS\">Read more<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"iawp_total_views":9,"footnotes":""},"categories":[5],"tags":[],"class_list":["post-555","post","type-post","status-publish","format-standard","hentry","category-tutorials-guides"],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v26.1 (Yoast SEO v26.1) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>RDP Hardening Checklist for Windows Server 2022 on a VPS - Windows VPS Blog<\/title>\n<meta name=\"description\" content=\"An RDP-exposed Windows Server 2022 VPS is one of the most relentlessly attacked services on the internet. Bots scan port 3389 within minutes of a host\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/windows-vps.org\/blog\/setup-rdp-windows-server-2022\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"RDP Hardening Checklist for Windows Server 2022 on a VPS\" \/>\n<meta property=\"og:description\" content=\"RDP Hardening Checklist for Windows Server 2022 on a VPS\" \/>\n<meta property=\"og:url\" content=\"https:\/\/windows-vps.org\/blog\/setup-rdp-windows-server-2022\/\" \/>\n<meta property=\"og:site_name\" content=\"Windows VPS Blog\" \/>\n<meta property=\"article:published_time\" content=\"2026-08-06T22:57:02+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-10-04T22:05:03+00:00\" \/>\n<meta name=\"author\" content=\"windows-vps\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@myxiechengxuan\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"windows-vps\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/windows-vps.org\/blog\/setup-rdp-windows-server-2022\/\",\"url\":\"https:\/\/windows-vps.org\/blog\/setup-rdp-windows-server-2022\/\",\"name\":\"RDP Hardening Checklist for Windows Server 2022 on a VPS - Windows VPS Blog\",\"isPartOf\":{\"@id\":\"https:\/\/windows-vps.org\/blog\/#website\"},\"datePublished\":\"2026-08-06T22:57:02+00:00\",\"dateModified\":\"2026-10-04T22:05:03+00:00\",\"author\":{\"@id\":\"https:\/\/windows-vps.org\/blog\/#\/schema\/person\/44caceed916d0db318aa08d5623a7a58\"},\"description\":\"An RDP-exposed Windows Server 2022 VPS is one of the most relentlessly attacked services on the internet. Bots scan port 3389 within minutes of a host\",\"breadcrumb\":{\"@id\":\"https:\/\/windows-vps.org\/blog\/setup-rdp-windows-server-2022\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/windows-vps.org\/blog\/setup-rdp-windows-server-2022\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/windows-vps.org\/blog\/setup-rdp-windows-server-2022\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/windows-vps.org\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"RDP Hardening Checklist for Windows Server 2022 on a VPS\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/windows-vps.org\/blog\/#website\",\"url\":\"https:\/\/windows-vps.org\/blog\/\",\"name\":\"Windows VPS Blog\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/windows-vps.org\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/windows-vps.org\/blog\/#\/schema\/person\/44caceed916d0db318aa08d5623a7a58\",\"name\":\"windows-vps\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/windows-vps.org\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/3f2573db5afcd1a6ab9abcc5d48fc8e42584bc87ab9d98cc156e5b2097766dd9?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/3f2573db5afcd1a6ab9abcc5d48fc8e42584bc87ab9d98cc156e5b2097766dd9?s=96&d=mm&r=g\",\"caption\":\"windows-vps\"},\"sameAs\":[\"https:\/\/windows-vps.org\/blog\",\"https:\/\/x.com\/myxiechengxuan\"],\"url\":\"https:\/\/windows-vps.org\/blog\/author\/myxiechengxuan\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"RDP Hardening Checklist for Windows Server 2022 on a VPS - Windows VPS Blog","description":"An RDP-exposed Windows Server 2022 VPS is one of the most relentlessly attacked services on the internet. Bots scan port 3389 within minutes of a host","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/windows-vps.org\/blog\/setup-rdp-windows-server-2022\/","og_locale":"en_US","og_type":"article","og_title":"RDP Hardening Checklist for Windows Server 2022 on a VPS","og_description":"RDP Hardening Checklist for Windows Server 2022 on a VPS","og_url":"https:\/\/windows-vps.org\/blog\/setup-rdp-windows-server-2022\/","og_site_name":"Windows VPS Blog","article_published_time":"2026-08-06T22:57:02+00:00","article_modified_time":"2026-10-04T22:05:03+00:00","author":"windows-vps","twitter_card":"summary_large_image","twitter_creator":"@myxiechengxuan","twitter_misc":{"Written by":"windows-vps","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/windows-vps.org\/blog\/setup-rdp-windows-server-2022\/","url":"https:\/\/windows-vps.org\/blog\/setup-rdp-windows-server-2022\/","name":"RDP Hardening Checklist for Windows Server 2022 on a VPS - Windows VPS Blog","isPartOf":{"@id":"https:\/\/windows-vps.org\/blog\/#website"},"datePublished":"2026-08-06T22:57:02+00:00","dateModified":"2026-10-04T22:05:03+00:00","author":{"@id":"https:\/\/windows-vps.org\/blog\/#\/schema\/person\/44caceed916d0db318aa08d5623a7a58"},"description":"An RDP-exposed Windows Server 2022 VPS is one of the most relentlessly attacked services on the internet. Bots scan port 3389 within minutes of a host","breadcrumb":{"@id":"https:\/\/windows-vps.org\/blog\/setup-rdp-windows-server-2022\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/windows-vps.org\/blog\/setup-rdp-windows-server-2022\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/windows-vps.org\/blog\/setup-rdp-windows-server-2022\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/windows-vps.org\/blog\/"},{"@type":"ListItem","position":2,"name":"RDP Hardening Checklist for Windows Server 2022 on a VPS"}]},{"@type":"WebSite","@id":"https:\/\/windows-vps.org\/blog\/#website","url":"https:\/\/windows-vps.org\/blog\/","name":"Windows VPS Blog","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/windows-vps.org\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/windows-vps.org\/blog\/#\/schema\/person\/44caceed916d0db318aa08d5623a7a58","name":"windows-vps","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/windows-vps.org\/blog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/3f2573db5afcd1a6ab9abcc5d48fc8e42584bc87ab9d98cc156e5b2097766dd9?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/3f2573db5afcd1a6ab9abcc5d48fc8e42584bc87ab9d98cc156e5b2097766dd9?s=96&d=mm&r=g","caption":"windows-vps"},"sameAs":["https:\/\/windows-vps.org\/blog","https:\/\/x.com\/myxiechengxuan"],"url":"https:\/\/windows-vps.org\/blog\/author\/myxiechengxuan\/"}]}},"_links":{"self":[{"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/posts\/555","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/comments?post=555"}],"version-history":[{"count":3,"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/posts\/555\/revisions"}],"predecessor-version":[{"id":834,"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/posts\/555\/revisions\/834"}],"wp:attachment":[{"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/media?parent=555"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/categories?post=555"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/tags?post=555"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}