Windows administrators have three realistic remote access protocols: RDP for graphical sessions, VNC\/ RFB for console-level access, and SSH for text and automation. They are not competitors so much as different layers \u2014 most well-built servers use all three. This article compares them on transport, encryption, authentication, bandwidth, and licensing so you can pick deliberately instead of by habit.<\/p>\n\n\n\n
RDP<\/strong> does not transmit pixels by default. It transmits drawing primitives \u2014 “draw this glyph here”, “update this rectangle” \u2014 and caches bitmaps persistently on both ends. That is why RDP feels interactive over connections where a pixel-streaming protocol would be unusable.<\/p>\n\n\n\n VNC<\/strong> (RFB) transmits framebuffer updates. It is protocol-agnostic and works even at a pre-boot console, but it moves far more data and, unless tunnelled, is unencrypted. Its strength is being able to see a machine when there is no operating system session to log into.<\/p>\n\n\n\n SSH<\/strong> gives you a command channel, encrypted and authenticated by key. Windows ships an OpenSSH Server feature, and it is the right tool for anything scriptable: file transfer, service restarts, log tailing, and remote PowerShell.<\/p>\n\n\n\n Everything you need is already installed and licensed. The trade-offs are that RDP has no pre-boot visibility, a single compromised password is enough to reach a full desktop, and leaving 3389 open to the internet invites continuous brute-force traffic.<\/p>\n\n\n\n VNC’s genuine use case on Windows is the hypervisor console: when the VM is stuck at a boot screen or RDP’s own service is broken, a VNC\/KVM-over-IP console is the only way in. As a daily administration channel it is slower, less secure by default, and weaker at multi-user work than RDP.<\/p>\n\n\n\n That last step is the one people get wrong. On Windows, keys for members of the Administrators group must live in The strongest configuration tunnels RDP through SSH so port 3389 never faces the internet:<\/p>\n\n\n\n Now the only exposed service is SSH, which is authenticated by key rather than by a password that a botnet can guess. The RDP traffic is encrypted twice, and brute-force noise drops to zero because there is no port 3389 to scan.<\/p>\n\n\n\n Use RDP for graphical work, SSH for anything you would otherwise do twice by hand, and VNC only for out-of-band console recovery. If you tunnel RDP over SSH and disable password authentication on both, you get a server that is comfortable to use and effectively invisible to automated attackers. For the wider context of running this kind of server, windows-vps.org<\/a> covers remote desktop administration on hosted Windows machines end to end.<\/p>\n\n","protected":false},"excerpt":{"rendered":"Head-to-Head Comparison<\/h2>\n\n\n\n
Attribute<\/th> RDP<\/th> VNC (RFB)<\/th> SSH<\/th><\/tr><\/thead> Default port<\/td> TCP 3389 (UDP 3389 for RDP-UDP)<\/td> TCP 5900<\/td> TCP 22<\/td><\/tr> Graphical desktop<\/td> Yes, full<\/td> Yes, framebuffer<\/td> No<\/td><\/tr> Encryption<\/td> TLS + CredSSP\/NLA<\/td> None by default; needs SSH\/TLS tunnel<\/td> Always (AES, ChaCha20)<\/td><\/tr> Authentication<\/td> Password, smart card, NLA pre-auth<\/td> Password (often single, weak)<\/td> Public key + password + MFA possible<\/td><\/tr> Multi-user \/ concurrent sessions<\/td> Yes on Server SKUs; session brokering<\/td> Typically one shared framebuffer<\/td> Yes, one channel per connection<\/td><\/tr> Clipboard & drive redirection<\/td> Native<\/td> Partial, add-on dependent<\/td> Via SCP\/SFTP, not clipboard<\/td><\/tr> Typical bandwidth<\/td> 50\u2013300 kbps tuned; 2\u20135 Mbps full-motion<\/td> 1\u201310 Mbps at low colour depth<\/td> Under 50 kbps<\/td><\/tr> Works pre-boot \/ in BIOS<\/td> No<\/td> Yes (KVM-over-IP consoles)<\/td> No<\/td><\/tr> Automation friendly<\/td> Limited (UI automation only)<\/td> Poor<\/td> Excellent<\/td><\/tr> Licence cost<\/td> Included with Windows Server<\/td> Open and free (TigerVNC, TightVNC)<\/td> Open and free (OpenSSH)<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n RDP in Practice<\/h2>\n\n\n\n
:: Client side\nmstsc \/v:203.0.113.10:3389\n\n:: Server side: confirm enabled, NLA on, encryption level 3 (High)\nSet-ItemProperty 'HKLM:\\System\\CurrentControlSet\\Control\\Terminal Server' -Name fDenyTSConnections -Value 0\nSet-ItemProperty 'HKLM:\\System\\CurrentControlSet\\Control\\Terminal Server\\WinStations\\RDP-Tcp' -Name UserAuthentication -Value 1\nSet-ItemProperty 'HKLM:\\System\\CurrentControlSet\\Control\\Terminal Server\\WinStations\\RDP-Tcp' -Name MinEncryptionLevel -Value 3<\/code><\/pre>\n\n\n\nVNC in Practice<\/h2>\n\n\n\n
:: Never expose 5900 directly. Bind to loopback and tunnel:\n:: On the server, configure TightVNC\/TigerVNC to listen on 127.0.0.1:5900\n:: From your workstation:\nssh -L 5900:127.0.0.1:5900 admin@203.0.113.10\n:: Then point the VNC viewer at localhost:5900<\/code><\/pre>\n\n\n\nSSH on Windows Server<\/h2>\n\n\n\n
:: Install the built-in OpenSSH Server (Windows Server 2019+)\nAdd-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0\nStart-Service sshd\nSet-Service -Name sshd -StartupType Automatic\n\n:: Set the default shell to PowerShell for non-interactive use\nNew-ItemProperty -Path 'HKLM:\\SOFTWARE\\OpenSSH' -Name DefaultShell `\n -Value 'C:\\Program Files\\PowerShell\\7\\pwsh.exe' -PropertyType String -Force\n\n:: Key-based login: drop the public key into the administrators' file\n:: C:\\ProgramData\\ssh\\administrators_authorized_keys (ACL: SYSTEM + Administrators only)<\/code><\/pre>\n\n\n\nadministrators_authorized_keys<\/code>, not the per-user file, and the file’s ACL must be restricted or sshd<\/code> will silently refuse the key.<\/p>\n\n\n\n:: Remote administration without a desktop session\nssh admin@203.0.113.10 \"Get-Service W3SVC\"\nscp .\\deploy.zip admin@203.0.113.10:C:\/inetpub\/staging\/\nssh admin@203.0.113.10 \"Restart-Service W3SVC\"<\/code><\/pre>\n\n\n\nHybrid Setups Are the Norm<\/h2>\n\n\n\n
:: On the server, restrict RDP to loopback\nNew-NetFirewallRule -DisplayName 'RDP loopback only' -Direction Inbound -Protocol TCP -LocalPort 3389 `\n -RemoteAddress 127.0.0.1 -Action Allow\nSet-NetFirewallRule -DisplayName 'Remote Desktop - User Mode (TCP-In)' -Enabled False\n\n:: On your workstation, open a tunnel then connect mstsc to localhost\nssh -L 3389:127.0.0.1:3389 admin@203.0.113.10\nmstsc \/v:127.0.0.1:3389<\/code><\/pre>\n\n\n\nDecision Matrix<\/h2>\n\n\n\n
Task<\/th> Best protocol<\/th> Reason<\/th><\/tr><\/thead> Interactive GUI work, Office, browsers<\/td> RDP<\/td> Fast, licensed, redirects clipboard and drives<\/td><\/tr> Bulk file transfer<\/td> SSH (SCP\/SFTP)<\/td> Scriptable, resumable, encrypted<\/td><\/tr> Repeatable configuration changes<\/td> SSH + PowerShell<\/td> Idempotent, loggable, no UI<\/td><\/tr> Recovering a VM that will not boot<\/td> VNC \/ KVM console<\/td> Only option pre-OS<\/td><\/tr> Multiple admins on one server<\/td> RDP sessions or RDP Gateway<\/td> Session isolation and brokering<\/td><\/tr> Reaching a server across an untrusted network<\/td> SSH tunnel to RDP<\/td> Single hardened entry point<\/td><\/tr> Monitoring and log collection<\/td> SSH \/ WinRM<\/td> Text output, easily parsed<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n Hardening Checklist for All Three<\/h2>\n\n\n\n
PasswordAuthentication no<\/code>.<\/li>Bottom Line<\/h2>\n\n\n\n