RDP's default configuration (standard port, password authentication, unlimited login attempts) makes it a frequent brute-force target. This guide covers the essential hardening steps for any internet-facing Windows Server.
Prerequisites
- Windows Server VPS with RDP access
- Administrator privileges
Step 1 — Change the Default RDP Port
Open Registry Editor (regedit) and navigate to:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-TcpFind PortNumber, switch to Decimal, and change it from 3389 to a custom port (e.g. 33890).
Step 2 — Allow the New Port in Windows Firewall
New-NetFirewallRule -DisplayName "Custom RDP Port" -Direction Inbound -Protocol TCP -LocalPort 33890 -Action AllowRun this in an elevated PowerShell window.
Step 3 — Restart the Remote Desktop Service
Restart-Service TermService -ForceYour current RDP session will disconnect — reconnect using the new port (IP:33890) before removing the old firewall rule.
Step 4 — Enable Network Level Authentication (NLA)
In System Properties → Remote tab, ensure "Allow connections only from computers running Remote Desktop with Network Level Authentication" is checked. NLA requires authentication before a full session is established, reducing exposure to unauthenticated attacks.
Step 5 — Create a Dedicated Administrative Account
Avoid relying solely on the built-in Administrator account — see How to Create a New Administrator User on Windows Server, then optionally rename or disable the default Administrator account.
Step 6 — Enable Account Lockout Policy
Open Local Security Policy (secpol.msc) → Account Policies → Account Lockout Policy:
- Account lockout threshold:
5invalid attempts - Account lockout duration:
30minutes
This automatically blocks brute-force login attempts after repeated failures.
Step 7 — Restrict RDP Access to Specific IPs (Recommended)
In Windows Firewall with Advanced Security, edit the RDP inbound rule and set Scope → Remote IP address to only your trusted IP(s), rather than "Any."
Step 8 — Enforce Strong Passwords
In Local Security Policy → Account Policies → Password Policy, enable minimum length and complexity requirements.
Step 9 — Consider a VPN for RDP Access
For maximum security, don't expose RDP directly to the internet at all — require connecting through a VPN first, then RDP over the private network only.
Common Errors
Locked out after changing the port — use your VPS provider's console/VNC access to review firewall rules and registry settings.
NLA prevents connection from an older RDP client — update the client software rather than disabling NLA, since it's an important security control.
Best Practices
- Combine port change, NLA, account lockout, and IP restriction together — no single measure is sufficient alone
- Never leave the default Administrator account with a weak or default password
- Monitor failed login attempts via Event Viewer regularly
FAQ
Does changing the RDP port alone make the server secure?
No — it reduces automated scanning noise but should always be combined with NLA, account lockout policies, and IP restrictions for meaningful security.
Related Articles
- How to Connect to a Windows VPS via Remote Desktop (RDP)
- How to Configure Windows Firewall on a Windows VPS
- How to Create a New Administrator User on Windows Server
