In short
RDP (Remote Desktop) is how you reach a Windows VPS — and because it’s so useful, it’s one of the most attacked services on the internet. Left open with a weak password, a new Windows server can see brute-force attempts within hours.
Secure it in layers: strong unique passwords, restrict RDP to your own IP (or put it behind a VPN), enable Network Level Authentication and account lockout, add multi-factor authentication, and keep Windows patched. No single step is enough; together they make RDP a non-target.
If you’ve ever spun up a fresh Windows VPS, left RDP on its default settings, and then checked the security logs a day later, you already know the punchline: hundreds, sometimes thousands, of failed login attempts from IP addresses all over the world. That’s not someone targeting you — it’s automated bots sweeping the entire internet for open RDP, every minute of every day. The reassuring part is that these bots go for the easy doors. A few deliberate steps and they move on to the next victim. Here’s how to be the locked door, in plain, practical terms.
Why RDP is such a big target
RDP (the Remote Desktop Protocol) gives you the full Windows desktop of your server from anywhere — which is exactly why attackers want it. Get into RDP and you’re not peeking through a window, you’re sitting in the driver’s seat: full control of the machine. Combine that payoff with the fact that countless servers sit online with RDP wide open on the default port and predictable passwords, and you can see why it’s a favourite route for ransomware. The threat isn’t clever hacking most of the time — it’s patient, automated guessing at scale. Your job is to make the guessing pointless.
Security in layers: how much each step helps
No single setting makes RDP safe — but each layer you add dramatically shrinks your exposure. Here’s the rough effect of stacking them:
Each layer slams the door a bit harder (exposure to automated attacks — illustrative)
The biggest single jump is taking RDP off the open internet — locking it to your IP or a VPN. Everything else hardens what’s left.
The scenario: the server that got loud
A short, real example
You deploy a Windows VPS on a Friday, install your app, and leave RDP on the default port 3389 with an “Administrator” account and a decent-but-reused password. By Monday the Security event log has 40,000 failed logins. Nothing got in — this time — but the server’s been spending real CPU fending off guesses, and it only takes one weak password or one unpatched flaw. You spend ten minutes locking RDP to your office IP and adding account lockout. The log goes quiet the same hour. The attack didn’t stop; it just can’t reach the door anymore.
How to secure RDP on a Windows VPS, step by step
Work down this list in order — the early steps give you the most protection for the least effort:
1. Use strong, unique passwords — and rename the admin account. Long passphrases, never reused. Rename the default “Administrator” account so bots can’t guess the username either, and avoid obvious names like “admin” or “user.”
2. Restrict RDP to known IP addresses. This is the big one. In Windows Firewall, allow RDP only from your own IP or your office range, so the rest of the internet simply can’t reach port 3389. If your IP changes, a VPN gives you a stable address to allow.
3. Put RDP behind a VPN or gateway. Even better than IP-allowlisting: don’t expose RDP to the internet at all. Connect to a VPN first, then RDP across that private link. An RD Gateway does a similar job for teams. This takes RDP off the public internet entirely.
4. Enable Network Level Authentication (NLA). NLA forces the user to authenticate before a full session starts, which blocks a whole class of attacks. It’s a checkbox in your Remote Desktop settings — turn it on.
5. Set an account lockout policy. Lock an account after a handful of failed attempts (for a set time). This alone neutralises brute-forcing — bots can’t keep guessing if the account freezes after five tries.
6. Add multi-factor authentication (MFA). With MFA, a stolen or guessed password still isn’t enough — the attacker also needs the second factor. For a server holding anything important, this is well worth the small setup.
7. Consider changing the RDP port. Moving RDP off the default 3389 won’t stop a determined attacker, but it hides you from the simplest bots that only scan the default. Treat it as a minor extra layer, not a real defence on its own.
8. Keep Windows patched. Turn on updates and apply them. Some of the worst RDP incidents in history exploited flaws that already had a patch available. Updating is the least glamorous and most important habit here.
What to do if RDP is already under attack
If your logs are full of failed logins right now, don’t panic — failed means they haven’t got in. Do three things immediately: restrict RDP to your IP (or pull it behind a VPN) so the attempts can’t reach the server, confirm every account has a strong unique password and enable account lockout, and check the logs for any successful logins you don’t recognise. If you find one, treat the server as compromised — change credentials from a clean machine, review what changed, and consider rebuilding. Prevention is ten minutes; cleanup is a bad week.
The platform underneath matters too
Hardening Windows is your job; giving you the control and the tools to do it is the host’s. You want genuine administrator access to configure the firewall and policies the way you need (not a locked-down panel that fights you), reliable daily backups so a worst case is recoverable, and a network you can trust. hosting662 gives you full RDP-access Windows VPS with real control, Ceph SSD storage across three clusters, dedicated IPv4 and daily backups, in our own EU datacenter. If you’re also choosing a Windows version, our guide on which Windows Server version to run pairs well with this, and the production checklist covers the rest of a safe launch.
A Windows VPS you can actually lock down
Full RDP access, your own firewall control, daily backups — in our own EU datacenter.
See Windows VPS optionsFrequently asked questions
How do I secure RDP on a Windows VPS?
Secure it in layers: use strong, unique passwords and rename the admin account; restrict RDP to your own IP in the firewall or put it behind a VPN; enable Network Level Authentication and an account lockout policy; add multi-factor authentication; and keep Windows patched. The highest-impact step is taking RDP off the open internet by allowlisting your IP or using a VPN.
Is it safe to leave RDP open to the internet?
No. RDP left open on the default port is constantly scanned and brute-forced by automated bots, and it’s a common entry point for ransomware. Even with a strong password, you should restrict access to known IP addresses or require a VPN, so the service isn’t reachable by the whole internet.
Should I change the default RDP port (3389)?
Changing the port hides you from the simplest bots that only scan 3389, so it’s a small useful layer — but it’s not real security on its own, because a determined attacker can find the new port. Use it in addition to IP restriction, NLA, lockout and MFA, never instead of them.
Do I need a VPN if I use RDP?
It’s one of the best protections. Putting RDP behind a VPN means it isn’t exposed to the public internet at all — you connect to the VPN first, then reach RDP over that private link. It also gives you a stable IP to allowlist. For any server that matters, a VPN or RD Gateway is strongly recommended.
What is Network Level Authentication (NLA)?
NLA requires a user to authenticate before a full remote session is created, rather than after. That blocks a class of attacks that target the login screen itself and reduces the resources an unauthenticated connection can use. It’s a simple setting in Remote Desktop configuration and should always be enabled.
The bottom line
RDP is a magnet for automated attacks, but it’s a magnet you can switch off with a bit of layering. Take it off the open internet first — allowlist your IP or put it behind a VPN — then stack strong credentials, NLA, account lockout, MFA and patching on top. Do that and the endless brute-force noise simply can’t reach your server. Ten minutes of setup buys you a VPS that bots give up on.
Running Windows where you control the stack makes all of this easier — see hosting662’s Windows VPS, with full RDP access and daily backups in our own EU datacenter.
Comments
No comments yet. You can be the first.