Connect to a Windows VPS with RDP and Secure It

Remote Desktop Protocol (RDP) gives you the full Windows desktop of your VPS from anywhere. It is also one of the most attacked services on the internet, so connecting is only half the job; this guide covers how to connect to a Windows VPS with RDP and then lock it down.

Before you start

Your VPS IP address, the Administrator username and password.
An RDP client: built into Windows; Windows App (formerly Microsoft Remote Desktop) on macOS, iOS and Android; Remmina or FreeRDP on Linux.

Connect from Windows

Press Win + R, type mstsc and press Enter.
Enter the server IP (add :3390 if you use a custom port) and click Connect.
Enter Administrator and the password. Accept the certificate warning the first time (the default certificate is self-signed).

Under Show Options → Local Resources you can share the clipboard and local drives, which is the easiest way to copy files to the server.

Connect from macOS or Linux

macOS: install Windows App from the App Store, click + → Add PC, enter the IP and save the user account.
Linux: xfreerdp /v:203.0.113.10 /u:Administrator /dynamic-resolution +clipboard, or add a connection in Remmina.

Secure Remote Desktop

Use a strong password and a separate admin account

Bots try Administrator first. Create a new admin user, add it to the Administrators group, and use a long unique password:

net user mdmadmin * /add
net localgroup Administrators mdmadmin /add

After testing the new login, you can disable the built-in account with net user Administrator /active:no.

Keep Network Level Authentication on

System Properties → Remote (run SystemPropertiesRemote): keep Allow connections only from computers running Remote Desktop with Network Level Authentication ticked. NLA authenticates before a session starts, which blocks many attacks.

Set an account lockout policy

Open secpol.msc → Account Policies → Account Lockout Policy and set, for example, 5 invalid attempts, 15-minute lockout duration and reset counter. Windows Server 2022 and later also include built-in lockout for the Administrator account.

Limit RDP to your IP

The most effective step: allow port 3389 only from addresses you trust. In PowerShell as administrator:

Set-NetFirewallRule -DisplayGroup "Remote Desktop" -RemoteAddress 198.51.100.25

Replace the IP with yours (find it with the IP checker). If your IP changes often, use a VPN such as WireGuard and allow only the VPN range.

Warning: if your IP changes after you restrict RDP, you will be locked out. Make sure you have VNC/console access from your provider before applying IP limits.

Optionally change the RDP port

A non-standard port reduces log noise but is not real security. Set the new port, open it in the firewall and restart the service:

Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name PortNumber -Value 3390

New-NetFirewallRule -DisplayName "RDP 3390" -Direction Inbound -Protocol TCP -LocalPort 3390 -Action Allow

Restart-Service TermService -Force

Keep Windows updated

Several critical RDP vulnerabilities have been patched over the years. Install updates through Settings → Windows Update and reboot regularly.

Check for attacks

In Event Viewer, Windows Logs → Security, filter for event ID 4625 (failed logon). Thousands of entries from random IPs mean RDP is exposed and should be IP-restricted.

Troubleshooting

Remote Desktop can't connect to the remote computer: check the IP and port, that the VPS is running, and that the firewall rule allows your IP.
An authentication error has occurred / CredSSP: update both client and server; mismatched patch levels cause this.
The user account has been locked: wait for the lockout duration or unlock it from the provider console.
Too many users already logged in: Windows Server allows two admin sessions without RDS licences. Log off disconnected sessions with query user and logoff <id>.

Windows RDP FAQ

How many people can use RDP at once?

Two simultaneous administrative sessions are included. More users need Remote Desktop Services CALs.

Is RDP encrypted?

Yes, RDP traffic is TLS-encrypted. The danger is password guessing and unpatched flaws, not eavesdropping.

Should I use a VPN for RDP?

Yes, if you can. Putting RDP behind a VPN or an IP allowlist removes it from internet-wide scanning.

Next steps

Was this guide helpful?

Still stuck?

Ask MdmHost AI for a quick answer, or open a ticket and our team will take a look. We are here 24/7.

Ask MdmHost AI Open a ticket