How to Secure RDP: A 12-Step Checklist for Your Windows VPS

Why RDP servers get attacked

Any server with port 3389 open to the internet gets checked all the time by robots (bots). The bots try common usernames and passwords again and again — this is called a brute-force attack. It does not mean someone chose you; it happens to every server. The checklist below makes these attempts useless.

Keep your RDP safe: the 6 most important steps

The RDP security checklist

1. Change the password the first time you log in. Use at least 16 characters, and do not use it anywhere else. A password manager makes this easy. Press Ctrl + Alt + End → “Change a password”.
2. Keep Network Level Authentication (NLA) on. System Properties → Remote → “Allow connections only from computers running Remote Desktop with Network Level Authentication”. It makes people log in before any session starts.
3. Turn on account lockout. Run secpol.msc → Account Policies → Account Lockout Policy. Lock the account after about 10 wrong tries, for 15–30 minutes. Microsoft now also lets the built-in Administrator be locked out this way (“Allow Administrator account lockout”).
4. Make a second administrator account with its own strong password, so if one account gets locked you can still get in. You can also rename the built-in Administrator account, so bots guess the wrong name.
5. Run Windows Update now, and then every month. Updates fixed most serious RDP security holes, like “BlueKeep” in 2019, long before attackers used them widely.
6. Allow RDP only from your IP, if your IP is fixed. Windows Defender Firewall → Inbound Rules → Remote Desktop → Scope → add your own IP. Everyone else is blocked. Many home internet connections in Pakistan change IP often — if yours does, skip this step or you will lock yourself out.
7. Think about changing the port from 3389 to another number (see below). It will not stop a serious attacker, but it stops most bot attempts.
8. Give other people their own accounts instead of sharing Administrator. Remove their accounts when they leave.
9. Keep Windows Defender on and let it update. Do not install software from places you do not trust.
10. Log off instead of just closing the window when you finish, especially on a shared computer.
11. Keep backups away from the server. Copy important files to cloud storage or another computer on a regular schedule. A server is not a backup.
12. Check failed logins now and then. Event Viewer → Windows Logs → Security, event ID 4625 (see below).

Set up account lockout (stop password guessing)

Stop password-guessing bots with account lockout

1. Make a second admin account first, so you are never fully locked out.
2. Press Windows + R, type secpol.msc and press Enter.
3. Open Account Policies → Account Lockout Policy.
4. Set Account lockout threshold to 10 invalid logon attempts.
5. Set Account lockout duration and Reset account lockout counter after to 15 minutes or more.

How to change the RDP port safely

Do the steps in this order, or you can lock yourself out.

1. Open the new port first. In Windows Defender Firewall, add two new inbound rules that allow your new port (for example 50123) — one for TCP and one for UDP.
2. Press Windows + R, type regedit, and go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp.
3. Double-click PortNumber, choose Decimal, type the new port and click OK.
4. Restart the server.
5. Connect with the new port after a colon: 203.0.113.10:50123.

Not comfortable editing the registry? Ask our support team and we will do it with you.

How to see if someone tried to break in

Open Event Viewer → Windows Logs → Security and click “Filter Current Log”. Type 4625 (failed login). Each event shows the time, the username tried and the IP address it came from. “Logon Type 10” means a Remote Desktop login. Many failed logins from unknown IPs are normal bot scanning — it means your lockout and password are doing their job. Watch for 4624 (successful login) at a time or from an IP you do not recognise.

What to do if you think your RDP was hacked

1. Change the passwords of every account on the server right away.
2. Check Event Viewer for successful logins (4624) you do not recognise, and remove any new user accounts you did not create.
3. Run a full scan with Windows Defender.
4. Change the passwords of any websites you logged into from the server.
5. Message our support team. If needed, we can reinstall the server cleanly — back up your files first.

Extra protection (optional)

• Two-step login (2FA) — extra tools can ask for a code from your phone when you log in. They need setup; ask us if you want help choosing one.
• A VPN — you can hide RDP behind your own VPN so only VPN users can reach it. WireGuard VPS

What not to do

• Do not turn NLA off to “fix” a connection error. Update your Remote Desktop app instead.
• Do not use the same password as your email or social media.
• Do not share the Administrator login in chat groups.
• Do not skip Windows Update for months.

Linux servers

For a Linux VPS, the same ideas apply over SSH, the way you log in to Linux servers. Log in with a key and turn off password login. Keep packages updated. Turn on a firewall such as ufw, and open only the ports you need. You can also use fail2ban to block people who keep failing to log in.

Cannot connect after making these changes? See RDP will not connect.

Quick summary

• Long unique password + NLA + account lockout + Windows Update stop almost all attacks.
• Allow only your IP if it never changes.
• Change the port only after opening the new port in the firewall.
• Check event 4625 for failed logins and 4624 for successful ones.

Frequently asked

Roman Urdu mein sawal jawab