How to Secure a Windows RDP Server: 8 Steps That Matter

Short answer: the most effective protection for a Windows RDP server is to let only your own IP address reach port 3389, so password-guessing bots never get a login screen. Then change the first password to a long one, keep Network Level Authentication on, turn on account lockout, and let Windows install updates. On Rdp.Vision the first step is one click: the firewall on your server page has an "RDP only from my IP" template.

Any server with Remote Desktop open to the internet gets login attempts from bots within hours of going online. They try common usernames and leaked passwords, thousands of times. None of that is aimed at you personally, and none of it gets in if you do the steps below.

01The 8 Steps at a Glance

021. Let Only Your IP Reach Port 3389

A login screen that bots can't reach can't be guessed.

Open your server page, go to Firewall and add the RDP only from my IP template. It allows port 3389 from the address you're using right now and blocks it for everyone else. Your server keeps working normally for everything else.

Changing the port (say from 3389 to 53389) cuts down noise in the logs, but scanners find other ports too. It's a nice extra, not a replacement for step 1.

032. Change the First Password

The dashboard keeps the first administrator password so you can look it up. Change it after your first login: press Ctrl + Alt + End in the Remote Desktop window and choose Change a password. Use a password manager and at least 16 random characters.

043. Keep Network Level Authentication On

Network Level Authentication (NLA) makes the client prove who it is before Windows shows a login screen. It's on by default; to check, run SystemPropertiesRemote and make sure Allow connections only from computers running Remote Desktop with Network Level Authentication is ticked. Don't turn it off to work around a connection error; update the Remote Desktop app on your own device instead. See Remote Desktop Can't Connect?

054. Turn On Account Lockout

Open PowerShell as administrator:

# Lock an account for 15 minutes after 10 wrong passwords
net accounts /lockoutthreshold:10 /lockoutduration:15 /lockoutwindow:15

On some Windows versions the built-in Administrator account is exempt from lockout, one more reason why step 1 comes first. With step 1 in place you'll rarely see it trigger.

065. Let Windows Update

Security updates close the holes that worms use. Leave Windows Update on and set active hours so restarts happen when you're not using the server. A restart from the dashboard after updates takes about two minutes.

076. Add a Second Administrator

Create a second administrator account with its own strong password, so a lockout or a forgotten password on one doesn't lock you out completely:

$pw = Read-Host -AsSecureString "Password"
New-LocalUser -Name "ops" -Password $pw
Add-LocalGroupMember -Group "Administrators" -Member "ops"

087. Don't Spread Your Password

• Don't save the password inside .rdp files you send to others or keep in shared folders.
• Don't share one login between several people: Windows Server allows two administrator sessions at once, so give each person their own account.
• Never send passwords to support. We never ask for them.

098. Keep Copies Off the Server

A reinstall wipes the disk, and so can a mistake. Keep important files, bot configs and EA settings somewhere else: your own computer or a cloud storage you trust.