Windows VDS Remote Desktop Security: A 7 Step Checklist

Windows VDS Remote Desktop Security

An internet facing remote desktop (RDP) port starts getting scanned the moment it goes live. Attackers sweep for open 3389 ports around the clock and throw common username and password combinations at whatever answers. Here are the steps to take on the first day of a new Windows VDS. The same measures apply to Forex VDS machines running MetaTrader terminals. If you do not have a server yet, the Windows VDS page shows which plan and which Windows build fit your workload.

1. Change the Remote Desktop Port

Port 3389 is the first thing automated scanners look for. Changing it does not make you invisible, but it cuts out most of the noise:

Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name PortNumber -Value 53389
New-NetFirewallRule -DisplayName "RDP-Custom" -Direction Inbound -Protocol TCP -LocalPort 53389 -Action Allow

⚠️ Before you reboot, make absolutely sure the new firewall rule exists. Without it you will lock yourself out of the server the moment it comes back up.

From now on you specify the port when connecting: 88.x.x.x:53389

2. Restrict Access to Your Own IP Address

This is the single most effective step on the list. If you have a static IP, open the RDP rule to that address only:

Set-NetFirewallRule -DisplayName "RDP-Custom" -RemoteAddress "88.x.x.x"

For several addresses:

Set-NetFirewallRule -DisplayName "RDP-Custom" -RemoteAddress @("88.x.x.x","212.x.x.x")

If your IP changes, you can allow the range your home or office ISP assigns, or combine this step with a VPN.

3. Keep Network Level Authentication Enabled

NLA forces authentication before a session is created, so unauthenticated requests never reach the desktop:

Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name UserAuthentication -Value 1

💡 With NLA on, older clients may throw a CredSSP error. We covered the fix in our CredSSP connection error article. The answer is to update the client, not to turn NLA off.

4. Rename the Default Account and Use a Strong Password

Nearly every brute force attempt tries the username Administrator. Renaming the account invalidates most of them outright:

Rename-LocalUser -Name "Administrator" -NewName "custom_admin"

For the password: at least 16 characters, nothing that appears in a dictionary, and not reused anywhere else.

5. Define an Account Lockout Policy

Temporarily locking an account after a handful of failed attempts makes brute forcing impractical:

net accounts /lockoutthreshold:5 /lockoutduration:30 /lockoutwindow:30

This locks the account for 30 minutes after 5 failed attempts within a 30 minute window.

6. Close the Ports You Do Not Need

Only the ports you actually use should be open. List the current rules:

Get-NetFirewallRule -Enabled True -Direction Inbound | Select-Object DisplayName, Profile

Block unused services such as FTP, SMB and WinRM at the edge. If you run a database, never expose MSSQL on 1433 or MySQL on 3306 to the internet.

7. Do Not Skip Updates and Backups

• Apply Windows updates on a schedule; RDP has had critical vulnerabilities in the past
• Keep backups of important data on a separate server
• Check Security → 4625 events in Event Viewer periodically, which is where failed logon attempts show up

Get-EventLog -LogName Security -InstanceId 4625 -Newest 20 | Format-Table TimeGenerated, Message -AutoSize

If that list is long, it means steps 1 and 2 are still waiting for you.

Quick Checklist

Conclusion

Remote desktop security does not require expensive tooling. These seven steps neutralise virtually every automated attack. The two with the biggest payoff are restricting access to your own IP and setting an account lockout policy.

👉 Browse our remote desktop server plans for machines built around RDP workloads.