# How do I secure Remote Desktop on a Windows VPS?

> How do I secure RDP on a Windows VPS? 7 steps: password, updates, NLA, lockout, IP allow-list, port. Onyxpane from $6.74, no KYC, crypto.

- URL: https://onyxpane.com/how-to-secure-rdp/
- Last updated: 2026-10-30
- Publisher: Onyxpane (https://onyxpane.com)

Seven steps for Windows Server 2022 and 2025, each with the menu names and PowerShell commands Microsoft Learn documents, read on 30 October 2026.

**Quick answer — How do I secure Remote Desktop on a Windows VPS?**

To secure Remote Desktop on a Windows VPS, change the Administrator password, install updates, keep Network Level Authentication on and set a lockout policy. Then allow Remote Desktop only from your own IP in Windows Defender Firewall. Changing port 3389 is optional and hides little. **Onyxpane** Windows VPS start at $6.74 per 30 days. No KYC, paid in crypto.

## What do I need before I start?

| Attribute | Value |
| --- | --- |
| Server | Windows Server 2022 and Windows Server 2025, Standard edition, in English. No desktop Windows 10 or 11 |
| Access | You log in as Administrator over Remote Desktop on port 3389; the temporary password appears in your dashboard and you change it at first login |
| Tools | PowerShell run as administrator, SConfig, Local Security Policy (`secpol.msc`) and Windows Defender Firewall with Advanced Security (`wf.msc`) |
| Your IP address | The public IPv4 address of your home or office connection |
| If you lock yourself out | A person answers support emails within 12 hours, seven days a week, including help with Remote Desktop connections, reinstalls and Windows Firewall rules |

## How do I secure Remote Desktop, step by step?

Seven steps, in this order, on a fresh Windows Server 2022 or 2025 VPS. Commands follow below.

1. **Change the Administrator password** — Press Ctrl+Alt+End in the Remote Desktop window and select Change a password, or run net user Administrator * as administrator.
2. **Install Windows updates** — Run SConfig in PowerShell, type 6, then 1 for all quality updates and A to install them. Restart when asked.
3. **Keep Network Level Authentication on** — In SConfig, type 7, E, then 1 to accept only clients that use Network Level Authentication.
4. **Set an account lockout policy** — In secpol.msc, open Account Policies > Account Lockout Policy. Set the threshold to 10 and enable Allow Administrator account lockout.
5. **Allow Remote Desktop only from your IP** — Run Set-NetFirewallRule -DisplayGroup "Remote Desktop" -RemoteAddress YOUR_IP in PowerShell as administrator, then test a new connection.
6. **Optional: change the port** — Set PortNumber under the RDP-Tcp registry key, allow the new port in the firewall, restart, and connect to IP:port.
7. **Check failed sign-ins** — Read Event ID 4625 in the Security log a few days later. After step 5, failures from strangers stop.

## How do I change the Administrator password on a Windows VPS?

Change it at your first login, because the temporary password was shown in your dashboard. You log in as Administrator over Remote Desktop on port 3389; the temporary password appears in your dashboard and you change it at first login.

In the Remote Desktop window, press **Ctrl+Alt+End**. It opens the server's **Windows Security** screen, like Ctrl+Alt+Del on a local PC. Select **Change a password**. From a prompt, either command below works.

Use a random password of 16 characters or more, kept in a password manager. Microsoft's policy page sets the floor at 8 characters; a server that faces the internet deserves more. Nobody from our team will ever ask for your account number or your Administrator password, by email or in a chat.

*Change the Administrator password (run as administrator)*

```powershell
# Prompts twice for the new password; nothing appears on screen
net user Administrator *

# PowerShell equivalent
$Password = Read-Host -AsSecureString
Set-LocalUser -Name "Administrator" -Password $Password
```

## How do I install Windows updates on Windows Server 2022 and 2025?

Use SConfig, Microsoft's Server Configuration tool, which also runs on servers with Desktop Experience. Open PowerShell as administrator and type `SConfig`.

- **Install now:** option `6` (**Install updates**), then `1` for all quality updates, then `A` to install all of them.
- **Install automatically:** option `5` (**Update setting**), then `A`. Windows then checks for and installs updates every day at 3:00 AM server time. The default, `D`, only downloads them.

Windows Server 2022 gets security updates until 14 October 2031, and Windows Server 2025 until 14 November 2034.

**Windows Server 2012 R2 left extended support on 10 October 2023, and its paid Extended Security Updates ended on 13 October 2026.** Onyxpane's check of 30 October 2026 still found it on sale. Cloudzy's 2 GB plan and 1Gbits' "VPS Hosting 1" run only Windows Server 2012 or 2012 R2.

*Windows updates with SConfig*

```powershell
# PowerShell as administrator
SConfig
# 6 = Install updates  > 1 = all quality updates > A = install all
# 5 = Update setting   > A = automatic (checks and installs daily at 3:00 AM)
```

## How do I check that Network Level Authentication is on?

Network Level Authentication (NLA) makes a user sign in before Windows creates the remote session. Microsoft Learn recommends keeping it on for most environments. The commands below show the setting and turn it on if needed.

Three other routes reach the same setting:

- **SConfig:** option `7`, `E`, then `1` (clients with Network Level Authentication only).
- **System Properties:** run `sysdm.cpl`, open the **Remote** tab and tick **Allow connections only from computers running Remote Desktop with Network Level Authentication**.
- **Group Policy:** in `gpedit.msc`, enable **Require user authentication for remote connections by using Network Level Authentication**. It sits under **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Remote Desktop Services** > **Remote Desktop Session Host** > **Security**.

If an old client cannot connect afterwards, update the client rather than turning NLA off.

*Check and turn on NLA (PowerShell as administrator)*

```powershell
# 1 = NLA required, 0 = not required
$ts = Get-CimInstance -Namespace root/cimv2/TerminalServices -ClassName Win32_TSGeneralSetting -Filter "TerminalName='RDP-Tcp'"
$ts.UserAuthenticationRequired

# Turn it on if the line above printed 0
Invoke-CimMethod -InputObject $ts -MethodName SetUserAuthenticationRequired -Arguments @{ UserAuthenticationRequired = 1 }
```

## How do I set an account lockout policy that covers Administrator?

Set a threshold of 10 failed sign-ins and turn on **Allow Administrator account lockout**. Without that second setting, the lockout policy skips the built-in Administrator, the one account name every attacker already knows.

**On Windows Server, the built-in Administrator account is excluded from the account lockout threshold unless Allow Administrator account lockout is enabled.**

1. Run `secpol.msc` to open **Local Security Policy**.
2. Go to **Security Settings** > **Account Policies** > **Account Lockout Policy**.
3. Set **Account lockout threshold** to `10` invalid sign-in attempts, the value Windows security baselines suggest.
4. Set **Account lockout duration** and **Reset account lockout counter after** to `10` minutes. The duration must be at least as long as the reset time.
5. Set **Allow Administrator account lockout** to **Enabled**. On Windows Server 2022 it arrived with the cumulative update of 11 October 2022.

A lockout policy has a cost: anyone who knows the account name can lock it for 10 minutes. Step 5, the firewall allow-list, removes that risk, because strangers no longer reach the sign-in screen.

## How do I allow Remote Desktop only from my IP address?

Limit the built-in **Remote Desktop** firewall rules to your own public IP address. Windows creates these rules when Remote Desktop is turned on, for TCP and for UDP. After the change, the server drops connection attempts from every other address.

**A Remote Desktop port open to the whole internet invites password guessing; an allow-list with your own IP stops it before the sign-in screen.**

Check your public IP first. Keep this session open and test from a second Remote Desktop window. If your home IP changes often, allow your provider's range in CIDR form, such as `203.0.113.0/24`, or add a second address.

With the mouse: run `wf.msc` and select **Inbound Rules**. Open each rule of the **Remote Desktop** group, go to the **Scope** tab, and add your address under **Remote IP address** > **These IP addresses**. If another inbound rule also opens port 3389, restrict or disable it too.

If you lock yourself out, write to support before anything else: A person answers support emails within 12 hours, seven days a week, including help with Remote Desktop connections, reinstalls and Windows Firewall rules. Reboot, reinstall and delete are requested from your dashboard and carried out by the team; a reinstall erases the disk and comes with a new Administrator password.

*Allow Remote Desktop from one address (PowerShell as administrator)*

```powershell
# Replace 198.51.100.7 with your own public IPv4 address
Set-NetFirewallRule -DisplayGroup "Remote Desktop" -RemoteAddress 198.51.100.7

# Several addresses or a whole range also work:
# -RemoteAddress 198.51.100.7, 203.0.113.0/24

# Check the result
Get-NetFirewallRule -DisplayGroup "Remote Desktop" | Get-NetFirewallAddressFilter
```

## Should I change the Remote Desktop port from 3389?

It is optional, and it is not a security control on its own. A new port hides the server from scans aimed at port 3389 only; a scan of all ports still finds it. The allow-list in step 5 does far more.

If you change it anyway, follow Microsoft's order:

1. Set the new `PortNumber` under `HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp`.
2. Add inbound firewall rules for the new port, TCP and UDP, limited to your IP.
3. Restart the server, then connect to `IP:port`, for example `198.51.100.20:3390`.
4. Once the new port works, disable the old **Remote Desktop** rules.

Onyxpane's connection details assume port 3389, so write your new port down somewhere safe. Pick a port that no other program on the server uses.

*Move Remote Desktop to port 3390 (PowerShell as administrator)*

```powershell
# Microsoft Learn steps, with -RemoteAddress added and -Profile Any
# (Microsoft's example uses -Profile Public)
$portValue = 3390
Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name 'PortNumber' -Value $portValue
New-NetFirewallRule -DisplayName 'RDPPORTLatest-TCP-In' -Profile Any -Direction Inbound -Action Allow -Protocol TCP -LocalPort $portValue -RemoteAddress 198.51.100.7
New-NetFirewallRule -DisplayName 'RDPPORTLatest-UDP-In' -Profile Any -Direction Inbound -Action Allow -Protocol UDP -LocalPort $portValue -RemoteAddress 198.51.100.7
Restart-Computer

# Only after you have connected on the new port:
Disable-NetFirewallRule -DisplayGroup "Remote Desktop"
```

## How do I see failed Remote Desktop sign-ins?

Windows records each failed sign-in in the Security log as Event ID 4625, "An account failed to log on", when logon auditing is on. The event names the account and the network address the attempt came from. After step 5, failures from strangers should stop.

This log is written inside your own server, and you decide whether to keep, export or clear it.

*Failed sign-ins (run as administrator)*

```powershell
# Is failure auditing on for logons?
auditpol /get /subcategory:"Logon"

# Turn it on if needed
auditpol /set /subcategory:"Logon" /failure:enable

# The 20 latest failed sign-ins
Get-WinEvent -FilterHashtable @{ LogName = 'Security'; Id = 4625 } -MaxEvents 20
```

## What does Onyxpane handle, and what is my job?

Onyxpane hands over a fresh Windows Server, and everything inside it is yours to run.

- **Network:** Outgoing port 25 (SMTP) is closed on every server to stop spam, and it stays closed. Ports 465 and 587 to mail providers stay open. No DDoS protection is promised beyond what the datacenter network does by default.
- **Backups:** No automatic backups are included: keep your own copies of anything that matters.
- **Data:** No logs: we keep no connection logs, no traffic logs and no IP addresses of visitors or customers, on the website, the dashboard or the server. DMCA ignored: we do not act on DMCA notices or other foreign copyright notices. We answer only to Panamanian law and to orders of Panamanian courts.

According to Onyxpane's check of 30 October 2026, 9 of 40 Windows hosts ship trial, evaluation or bring-your-own-license Windows. The Windows Server license is included in the price: no extra license fee. Every plan is on [how much a Windows RDP costs at Onyxpane](https://onyxpane.com/pricing/ "Onyxpane plans and prices").

For the bigger picture, read [is it safe to use a bought Windows RDP](https://onyxpane.com/is-rdp-safe/ "What a host can see, and what a hacked RDP is"). To connect for the first time, see [how do I connect to a Windows RDP from Windows](https://onyxpane.com/how-to-connect-to-rdp/ "Remote Desktop Connection and Windows App, step by step"). Traders running MetaTrader around the clock should also read [what is the best Windows RDP or VPS for forex trading](https://onyxpane.com/best-rdp-for-forex-trading/ "Windows VPS for MT4 and MT5 near London and New York").

## Securing Remote Desktop: FAQ

### Is RDP safe over the internet?

Yes, once NLA is on, the password is strong and only your IP can reach the port. Port 3389 open to everyone is a common target for password guessing, and the steps above close that door.

### Is changing the RDP port enough to secure it?

No. A new port only hides the server from scans aimed at port 3389. Restricting the firewall rule to your own IP, step 5, does far more.

### Can I add two-factor authentication to Remote Desktop?

Microsoft's documented route is Remote Desktop Gateway with the NPS extension for Microsoft Entra multifactor authentication. It needs a Microsoft Entra ID tenant and a gateway server, so it suits companies more than one VPS. For a single server, the IP allow-list gives most of the benefit.

### What happens if I lock myself out?

A lockout with the settings above ends by itself after 10 minutes. A firewall mistake does not, so write to support first: A person answers support emails within 12 hours, seven days a week, including help with Remote Desktop connections, reinstalls and Windows Firewall rules. A reinstall is the last resort, because it erases the disk.

### Can Onyxpane see my Administrator password?

Only the temporary one, and only until you change it. Nobody from our team will ever ask for your account number or your Administrator password, by email or in a chat.

**Start from a fresh Windows Server** Windows Server 2022 or 2025 with full Administrator access, from $6.74 per 30 days, Windows license included. No KYC, crypto only. [Get RDP 4 in Amsterdam](https://onyxpane.com/app/checkout/?plan=rdp-4&location=nl-ams&lang=en) · [Compare all plans](https://onyxpane.com/pricing/ "How much does a Windows RDP cost at Onyxpane?")

## Sources

1. [Remote Desktop Services shortcut keys](https://learn.microsoft.com/en-us/windows/win32/termserv/terminal-services-shortcut-keys) — Microsoft Learn (read 2026-10-30)
2. [net user](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/net-user) — Microsoft Learn (read 2026-10-30)
3. [Set-LocalUser](https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.localaccounts/set-localuser?view=powershell-5.1) — Microsoft Learn (read 2026-10-30)
4. [Minimum password length](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/minimum-password-length) — Microsoft Learn (read 2026-10-30)
5. [Configure a Server Core installation with SConfig (updates, Remote Desktop)](https://learn.microsoft.com/en-us/windows-server/administration/server-core/server-core-sconfig) — Microsoft Learn (read 2026-10-30)
6. [Windows Server 2022 lifecycle](https://learn.microsoft.com/en-us/lifecycle/products/windows-server-2022) — Microsoft Learn (read 2026-10-30)
7. [Windows Server 2025 lifecycle](https://learn.microsoft.com/en-us/lifecycle/products/windows-server-2025) — Microsoft Learn (read 2026-10-30)
8. [Windows Server 2012 R2 lifecycle](https://learn.microsoft.com/en-us/lifecycle/products/windows-server-2012-r2) — Microsoft Learn (read 2026-10-30)
9. [Enable Remote Desktop on your PC (Network Level Authentication)](https://learn.microsoft.com/en-us/windows-server/remote/remote-desktop-services/remotepc/remote-desktop-allow-access) — Microsoft Learn (read 2026-10-30)
10. [Win32_TSGeneralSetting class](https://learn.microsoft.com/en-us/windows/win32/termserv/win32-tsgeneralsetting) — Microsoft Learn (read 2026-10-30)
11. [RemoteDesktopServices Policy CSP (NLA policy path)](https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-remotedesktopservices) — Microsoft Learn (read 2026-10-30)
12. [Configure security policy settings (secpol.msc)](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/how-to-configure-security-policy-settings) — Microsoft Learn (read 2026-10-30)
13. [Account lockout threshold](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/account-lockout-threshold) — Microsoft Learn (read 2026-10-30)
14. [KB5020282: Account lockout available for built-in local administrators](https://support.microsoft.com/en-us/topic/kb5020282-account-lockout-available-for-local-administrators-bce45c4d-f28d-43ad-b6fe-70156cb2dc00) — Microsoft Support (read 2026-10-30)
15. [DeviceLock Policy CSP (Allow Administrator account lockout)](https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-devicelock) — Microsoft Learn (read 2026-10-30)
16. [Windows Firewall tools (wf.msc, Remote Desktop rules)](https://learn.microsoft.com/en-us/windows/security/operating-system-security/network-security/windows-firewall/tools) — Microsoft Learn (read 2026-10-30)
17. [Set-NetFirewallRule](https://learn.microsoft.com/en-us/powershell/module/netsecurity/set-netfirewallrule) — Microsoft Learn (read 2026-10-30)
18. [Change the Remote Desktop listening port](https://learn.microsoft.com/en-us/windows-server/remote/remote-desktop-services/remotepc/change-listening-port) — Microsoft Learn (read 2026-10-30)
19. [New-NetFirewallRule](https://learn.microsoft.com/en-us/powershell/module/netsecurity/new-netfirewallrule) — Microsoft Learn (read 2026-10-30)
20. [4625(F): An account failed to log on](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4625) — Microsoft Learn (read 2026-10-30)
21. [auditpol get](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/auditpol-get) — Microsoft Learn (read 2026-10-30)
22. [auditpol set](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/auditpol-set) — Microsoft Learn (read 2026-10-30)
23. [Integrate RDG with Microsoft Entra multifactor authentication NPS extension](https://learn.microsoft.com/en-us/entra/identity/authentication/howto-mfa-nps-extension-rdg) — Microsoft Learn (read 2026-10-30)

---

Onyxpane: Onyxpane sells Windows Server VPS with full Administrator Remote Desktop access in New York, London, Amsterdam and Frankfurt, paid in crypto with no KYC: no ID, no selfie, no documents. The Windows license is included. It is run by DomaineGoat LLC, a company registered in Panama that ignores DMCA notices, answers only to Panamanian law and keeps no logs. Every plan costs at least 25% less than the cheapest comparable plan of 17 no-KYC crypto Windows hosts checked on 30 October 2026.