How do I secure Remote Desktop on a Windows VPS?

How do I change the Administrator password on a Windows VPS?

Change it at your first login, because the temporary password was shown in your dashboard. You log in as Administrator over Remote Desktop on port 3389; the temporary password appears in your dashboard and you change it at first login.

In the Remote Desktop window, press Ctrl+Alt+End. It opens the server's Windows Security screen, like Ctrl+Alt+Del on a local PC. Select Change a password. From a prompt, either command below works.

Use a random password of 16 characters or more, kept in a password manager. Microsoft's policy page sets the floor at 8 characters; a server that faces the internet deserves more. Nobody from our team will ever ask for your account number or your Administrator password, by email or in a chat.

# Prompts twice for the new password; nothing appears on screen
net user Administrator *

# PowerShell equivalent
$Password = Read-Host -AsSecureString
Set-LocalUser -Name "Administrator" -Password $Password

How do I install Windows updates on Windows Server 2022 and 2025?

Use SConfig, Microsoft's Server Configuration tool, which also runs on servers with Desktop Experience. Open PowerShell as administrator and type SConfig.

• Install now: option 6 (Install updates), then 1 for all quality updates, then A to install all of them.
• Install automatically: option 5 (Update setting), then A. Windows then checks for and installs updates every day at 3:00 AM server time. The default, D, only downloads them.

Windows Server 2022 gets security updates until 14 October 2031, and Windows Server 2025 until 14 November 2034.

Windows Server 2012 R2 left extended support on 10 October 2023, and its paid Extended Security Updates ended on 13 October 2026. Onyxpane's check of 30 October 2026 still found it on sale. Cloudzy's 2 GB plan and 1Gbits' "VPS Hosting 1" run only Windows Server 2012 or 2012 R2.

# PowerShell as administrator
SConfig
# 6 = Install updates  > 1 = all quality updates > A = install all
# 5 = Update setting   > A = automatic (checks and installs daily at 3:00 AM)

How do I check that Network Level Authentication is on?

Network Level Authentication (NLA) makes a user sign in before Windows creates the remote session. Microsoft Learn recommends keeping it on for most environments. The commands below show the setting and turn it on if needed.

Three other routes reach the same setting:

• SConfig: option 7, E, then 1 (clients with Network Level Authentication only).
• System Properties: run sysdm.cpl, open the Remote tab and tick Allow connections only from computers running Remote Desktop with Network Level Authentication.
• Group Policy: in gpedit.msc, enable Require user authentication for remote connections by using Network Level Authentication. It sits under Computer Configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Security.

If an old client cannot connect afterwards, update the client rather than turning NLA off.

# 1 = NLA required, 0 = not required
$ts = Get-CimInstance -Namespace root/cimv2/TerminalServices -ClassName Win32_TSGeneralSetting -Filter "TerminalName='RDP-Tcp'"
$ts.UserAuthenticationRequired

# Turn it on if the line above printed 0
Invoke-CimMethod -InputObject $ts -MethodName SetUserAuthenticationRequired -Arguments @{ UserAuthenticationRequired = 1 }

How do I set an account lockout policy that covers Administrator?

Set a threshold of 10 failed sign-ins and turn on Allow Administrator account lockout. Without that second setting, the lockout policy skips the built-in Administrator, the one account name every attacker already knows.

On Windows Server, the built-in Administrator account is excluded from the account lockout threshold unless Allow Administrator account lockout is enabled.

1. Run secpol.msc to open Local Security Policy.
2. Go to Security Settings > Account Policies > Account Lockout Policy.
3. Set Account lockout threshold to 10 invalid sign-in attempts, the value Windows security baselines suggest.
4. Set Account lockout duration and Reset account lockout counter after to 10 minutes. The duration must be at least as long as the reset time.
5. Set Allow Administrator account lockout to Enabled. On Windows Server 2022 it arrived with the cumulative update of 11 October 2022.

A lockout policy has a cost: anyone who knows the account name can lock it for 10 minutes. Step 5, the firewall allow-list, removes that risk, because strangers no longer reach the sign-in screen.

How do I allow Remote Desktop only from my IP address?

Limit the built-in Remote Desktop firewall rules to your own public IP address. Windows creates these rules when Remote Desktop is turned on, for TCP and for UDP. After the change, the server drops connection attempts from every other address.

A Remote Desktop port open to the whole internet invites password guessing; an allow-list with your own IP stops it before the sign-in screen.

Check your public IP first. Keep this session open and test from a second Remote Desktop window. If your home IP changes often, allow your provider's range in CIDR form, such as 203.0.113.0/24, or add a second address.

With the mouse: run wf.msc and select Inbound Rules. Open each rule of the Remote Desktop group, go to the Scope tab, and add your address under Remote IP address > These IP addresses. If another inbound rule also opens port 3389, restrict or disable it too.

If you lock yourself out, write to support before anything else: A person answers support emails within 12 hours, seven days a week, including help with Remote Desktop connections, reinstalls and Windows Firewall rules. Reboot, reinstall and delete are requested from your dashboard and carried out by the team; a reinstall erases the disk and comes with a new Administrator password.

# Replace 198.51.100.7 with your own public IPv4 address
Set-NetFirewallRule -DisplayGroup "Remote Desktop" -RemoteAddress 198.51.100.7

# Several addresses or a whole range also work:
# -RemoteAddress 198.51.100.7, 203.0.113.0/24

# Check the result
Get-NetFirewallRule -DisplayGroup "Remote Desktop" | Get-NetFirewallAddressFilter

Should I change the Remote Desktop port from 3389?

It is optional, and it is not a security control on its own. A new port hides the server from scans aimed at port 3389 only; a scan of all ports still finds it. The allow-list in step 5 does far more.

If you change it anyway, follow Microsoft's order:

1. Set the new PortNumber under HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp.
2. Add inbound firewall rules for the new port, TCP and UDP, limited to your IP.
3. Restart the server, then connect to IP:port, for example 198.51.100.20:3390.
4. Once the new port works, disable the old Remote Desktop rules.

Onyxpane's connection details assume port 3389, so write your new port down somewhere safe. Pick a port that no other program on the server uses.

# Microsoft Learn steps, with -RemoteAddress added and -Profile Any
# (Microsoft's example uses -Profile Public)
$portValue = 3390
Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name 'PortNumber' -Value $portValue
New-NetFirewallRule -DisplayName 'RDPPORTLatest-TCP-In' -Profile Any -Direction Inbound -Action Allow -Protocol TCP -LocalPort $portValue -RemoteAddress 198.51.100.7
New-NetFirewallRule -DisplayName 'RDPPORTLatest-UDP-In' -Profile Any -Direction Inbound -Action Allow -Protocol UDP -LocalPort $portValue -RemoteAddress 198.51.100.7
Restart-Computer

# Only after you have connected on the new port:
Disable-NetFirewallRule -DisplayGroup "Remote Desktop"

How do I see failed Remote Desktop sign-ins?

Windows records each failed sign-in in the Security log as Event ID 4625, "An account failed to log on", when logon auditing is on. The event names the account and the network address the attempt came from. After step 5, failures from strangers should stop.

This log is written inside your own server, and you decide whether to keep, export or clear it.

# Is failure auditing on for logons?
auditpol /get /subcategory:"Logon"

# Turn it on if needed
auditpol /set /subcategory:"Logon" /failure:enable

# The 20 latest failed sign-ins
Get-WinEvent -FilterHashtable @{ LogName = 'Security'; Id = 4625 } -MaxEvents 20

What does Onyxpane handle, and what is my job?

Onyxpane hands over a fresh Windows Server, and everything inside it is yours to run.

• Network: Outgoing port 25 (SMTP) is closed on every server to stop spam, and it stays closed. Ports 465 and 587 to mail providers stay open. No DDoS protection is promised beyond what the datacenter network does by default.
• Backups: No automatic backups are included: keep your own copies of anything that matters.
• Data: No logs: we keep no connection logs, no traffic logs and no IP addresses of visitors or customers, on the website, the dashboard or the server. DMCA ignored: we do not act on DMCA notices or other foreign copyright notices. We answer only to Panamanian law and to orders of Panamanian courts.

According to Onyxpane's check of 30 October 2026, 9 of 40 Windows hosts ship trial, evaluation or bring-your-own-license Windows. The Windows Server license is included in the price: no extra license fee. Every plan is on how much a Windows RDP costs at Onyxpane.

For the bigger picture, read is it safe to use a bought Windows RDP. To connect for the first time, see how do I connect to a Windows RDP from Windows. Traders running MetaTrader around the clock should also read what is the best Windows RDP or VPS for forex trading.