How to Connect to a Windows VPS With RDP (and Secure It)

A Windows VPS is administered through Remote Desktop: a full Windows desktop in a window on your own machine. It is convenient, and it is also the most attacked service on the internet — port 3389 receives millions of login attempts a day. Connect first, then spend fifteen minutes making sure only you can.

Connecting

You need the server's IP, a username (usually Administrator) and the password from your provider.

From Windows: press Start, type Remote Desktop Connection, enter the IP, click Connect, enter the credentials. Save a .rdp file for next time.

From macOS: install Windows App (formerly Microsoft Remote Desktop) from the App Store, add a PC with the IP and credentials.

From Linux: Remmina (GUI) or FreeRDP from the terminal:

bash

xfreerdp /v:203.0.113.10 /u:Administrator /p:'password' /size:1600x900 /cert:ignore

The first connection warns that the certificate is self-signed; that is expected for a fresh server.

1. Change the Administrator password

On a new VPS the password came to you by email or panel; assume it has been seen. Press Ctrl+Alt+End inside the session (that is Ctrl+Alt+Del for the remote machine), choose Change a password, and set something long. Then create a separate admin account with a non-obvious name and use that for daily work — bots try Administrator, admin and user first.

2. Require Network Level Authentication

NLA makes the client authenticate before a desktop session is even created, which blocks a class of attacks and cuts resource use from bots. System Properties → Remote → Allow connections only from computers running Remote Desktop with Network Level Authentication. On modern Windows Server it is on by default; check.

3. Move RDP off port 3389

Not real security — a port scan finds it in seconds — but it removes you from the mass scans that hit 3389 only, which are 99% of the noise. In PowerShell as Administrator:

powershell

Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name PortNumber -Value 33890
New-NetFirewallRule -DisplayName "RDP 33890" -Direction Inbound -Protocol TCP -LocalPort 33890 -Action Allow
Restart-Service TermService -Force

Reconnect using 203.0.113.10:33890. Only then remove the old firewall rule.

4. Restrict by IP

If you connect from a fixed address (office, home with a static IP), allow only that:

powershell

Set-NetFirewallRule -DisplayName "RDP 33890" -RemoteAddress 198.51.100.7

Add more addresses with a comma-separated list. If your IP changes, use the provider's console to get back in and update it; or use a VPN instead (below).

5. Account lockout

Stop password guessing from working even if it reaches the login: Local Security Policy → Account Policies → Account Lockout Policy — threshold 5 attempts, lockout duration 15 minutes. With a long password, five guesses in fifteen minutes is nothing.

6. The proper answer: a VPN or a gateway

The secure configuration is RDP not exposed to the internet at all. Options, in increasing effort:

Provider firewall — many VPS panels let you allow-list at the network edge, before traffic reaches Windows.
WireGuard VPN on the VPS or a small Linux box: connect to the VPN, then RDP to a private address. Setup: WireGuard on a VPS.
RD Gateway — Microsoft's HTTPS gateway for RDP, appropriate for teams.

7. Keep it updated

Windows Update, monthly, with the reboot it wants. The 2019 BlueKeep vulnerability was an RDP flaw that allowed unauthenticated remote code execution; patches existed for months before the mass exploitation. Enable automatic updates and schedule the restart for a quiet hour.

Check what is hitting you

Event Viewer → Windows Logs → Security, filter for Event ID 4625 (failed logon). On an unprotected server this fills with thousands of entries a day from all over the world. After the steps above it should be nearly empty. If it is not, something is still exposed.

Copying files

The RDP client can share a local drive (Local Resources → Drives) so the server sees your machine's disk; drag files in Explorer. For large transfers, WinSCP over SSH (Windows Server includes OpenSSH Server as an optional feature) is more reliable.

Whether Windows is the right OS for the workload at all is covered in Windows Server vs Linux for hosting.