Remote Desktop Protocol (RDP) is the primary way administrators connect to Windows Server. Out of the box, RDP is functional but not hardened \u2014 it listens on port 3389, accepts password authentication, and trusts the default self-signed certificate. This guide walks through a complete RDP setup on Windows Server 2022 and 2025, with security configurations that block the most common attack vectors while keeping remote access reliable.<\/p>\n\n\n\n
RDP is disabled by default on Windows Server. Enable it via PowerShell:<\/p>\n\n\n\n
Set-ItemProperty -Path 'HKLM:\\System\\CurrentControlSet\\Control\\Terminal Server' -Name \"fDenyTSConnections\" -Value 0\nEnable-NetFirewallRule -DisplayGroup \"Remote Desktop\"<\/code><\/pre>\n\n\n\nThis enables RDP and opens the firewall port. By default, only members of the local Administrators group can connect. Add specific users with Add-LocalGroupMember -Group \"Remote Desktop Users\" -Member \"username\"<\/code> to grant RDP access without granting full administrator privileges.<\/p>\n\n\n\nNetwork Level Authentication (NLA)<\/h2>\n\n\n\n
NLA requires the client to authenticate before establishing a full RDP session. This prevents resource exhaustion attacks and reduces the attack surface. NLA is enabled by default on Windows Server 2022 and later, but verify the setting:<\/p>\n\n\n\n
Get-ItemProperty -Path 'HKLM:\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server\\WinStations\\RDP-Tcp' -Name UserAuthentication<\/code><\/pre>\n\n\n\nA value of 1 means NLA is required. If it is 0, set it with Set-ItemProperty<\/code>. NLA must be supported by the client \u2014 Windows 10\/11, Windows Server 2012+, and the latest macOS Remote Desktop client all support it.<\/p>\n\n\n\nConfiguring RDP with a Proper TLS Certificate<\/h2>\n\n\n\n
The default self-signed certificate used by RDP triggers a warning on every connection. For production environments, bind a trusted SSL certificate to the RDP listener:<\/p>\n\n\n\n
\n- Obtain a certificate from a public CA (Let’s Encrypt, DigiCert, etc.) or your internal PKI with the server’s FQDN in the subject or SAN.<\/li>\n
- Ensure the certificate has the Server Authentication<\/strong> (1.3.6.1.5.5.7.3.1) extended key usage.<\/li>\n
- Store the certificate in the local machine’s Personal certificate store.<\/li>\n
- Use the certificate’s thumbprint to bind it to the RDP service.<\/li>\n<\/ul>\n\n\n\n
After setting the certificate, restart the Terminal Services service: Restart-Service TermService -Force<\/code>.<\/p>\n\n\n\nAccount Lockout Policies to Stop Brute Force<\/h2>\n\n\n\n
RDP is a common target for brute-force attacks. Configure account lockout policies via Local Security Policy:<\/p>\n\n\n\nPolicy<\/th> Recommended Setting<\/th><\/tr><\/thead> Account lockout threshold<\/td> 10 invalid logon attempts<\/td><\/tr> Account lockout duration<\/td> 30 minutes<\/td><\/tr> Reset account lockout counter after<\/td> 30 minutes<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\nSet these via PowerShell:<\/p>\n\n\n\n
net accounts \/lockoutthreshold:10 \/lockoutduration:30 \/lockoutwindow:30<\/code><\/pre>\n\n\n\nThis prevents attackers from trying thousands of passwords. Combined with NLA, the lockout is enforced before the RDP session is established.<\/p>\n\n\n\n
Changing the Default RDP Port<\/h2>\n\n\n\n
Changing the RDP port from 3389 to a non-standard port reduces automated scanning noise. While this is not a security measure against a determined attacker, it eliminates the constant background noise from port scanners:<\/p>\n\n\n\n
Set-ItemProperty -Path 'HKLM:\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server\\WinStations\\RDP-Tcp' -Name PortNumber -Value 3390\nRestart-Service TermService -Force\nNew-NetFirewallRule -DisplayName \"RDP-3390\" -Direction Inbound -Protocol TCP -LocalPort 3390 -Action Allow<\/code><\/pre>\n\n\n\nRemove the old firewall rule for port 3389 and replace it with a custom rule for your new port. Remember to update your firewall rules at the provider level as well.<\/p>\n\n\n\n
RDP Session Timeout and Idle Limits<\/h2>\n\n\n\n
Disconnected RDP sessions accumulate and consume server resources. Set idle timeouts and automatic disconnection:<\/p>\n\n\n\n
Set-ItemProperty -Path 'HKLM:\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server\\WinStations\\RDP-Tcp' -Name MaxIdleTime -Value 600000\nSet-ItemProperty -Path 'HKLM:\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server\\WinStations\\RDP-Tcp' -Name MaxDisconnectionTime -Value 300000<\/code><\/pre>\n\n\n\nThese settings log off idle sessions after 10 minutes of inactivity and terminate disconnected sessions after 5 minutes, freeing up license and memory resources.<\/p>\n\n\n\n
Restricting RDP Access by IP Address<\/h2>\n\n\n\n
For servers with a fixed set of administrators, restrict RDP access to specific IP addresses using Windows Defender Firewall with Advanced Security:<\/p>\n\n\n\n
$rule = Get-NetFirewallRule -DisplayGroup \"Remote Desktop\"\n$rule | Set-NetFirewallRule -RemoteAddress \"203.0.113.0\/24\",\"198.51.100.0\/24\"<\/code><\/pre>\n\n\n\nThis is one of the most effective RDP hardening measures. Even a brute-force attack against a strong password fails if the attacker’s IP address is not in the allowed range.<\/p>\n\n\n\n
Auditing RDP Logins<\/h2>\n\n\n\n
Enable audit logging for logon events to track RDP access:<\/p>\n\n\n\n
auditpol \/set \/subcategory:\"Logon\" \/success:enable \/failure:enable<\/code><\/pre>\n\n\n\nMonitor Event ID 4624 (successful logon) and 4625 (failed logon) from the Security event log. A sudden spike in 4625 events from the same source IP is a strong indicator of a brute-force attack in progress.<\/p>\n\n\n\n
Summary<\/h2>\n\n\n\n
A secure RDP setup on Windows Server requires more than just enabling Remote Desktop. NLA, proper TLS certificates, account lockout policies, IP address restrictions, and session timeouts work together to create a layered defense. Start with NLA and account lockout (they stop the most common attacks), then add certificate binding and IP restrictions for stronger protection. For hosting providers that offer managed RDP access, compare Windows VPS plans on our comparison table<\/a> to find a configuration that balances security and accessibility for your team.<\/p>\n","protected":false},"excerpt":{"rendered":"