If you have a Windows machine with Remote Desktop exposed to the internet, it is already being attacked. Port 3389 (RDP) is among the most scanned in the world: botnets try usernames and passwords 24 hours a day against any IP that answers. With four well-applied measures, a remote desktop can be reasonably secure.
1. A strong password (first things first)
Almost every RDP break-in is a guessed password. Use a long password (14-16 characters minimum), unique to that machine, and disable or rename accounts you do not use. If several people connect, give each their own user.
2. Enable NLA (Network Level Authentication)
With NLA, Windows requires authentication before creating the graphical session, which kills most automated attacks and historical RDP exploits outright. Modern Windows ships with it enabled; check it under Settings → System → Remote Desktop (the "require devices to use Network Level Authentication" option).
3. Change the RDP port
Moving away from 3389 will not stop a targeted attacker, but it removes 99% of the noise from mass scans (and their account lockouts, huge logs and scares). It is changed in the registry:
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 3390 /fThen create the firewall rule for the new port and restart the service (or the machine):
netsh advfirewall firewall add rule name="RDP alternate port" dir=in action=allow protocol=TCP localport=3390
net stop termservice & net start termserviceFrom then on, connect specifying the port: IP:3390 in the client.
Do it in this order: first the firewall rule for the new port, then the registry change and the service restart. If you close the old port before opening the new one, you will lock yourself out. On a VPS you always have the panel console to recover access.
4. Restrict who can connect (the most effective measure)
Ideally the RDP port should not be open to the whole internet, only to your IPs:
- In the Windows firewall: edit the Remote Desktop rule and, in its scope, limit "remote IP addresses" to yours.
- On a GINERNET VPS: even better, do it from the Manager firewall, outside the machine: open the RDP port only to your office or VPN IP. Scans never even reach the server.
- If your IP is dynamic, a VPN (for example WireGuard on the VPS itself) gives you a fixed IP to allow RDP from.
5. Keep Windows updated
The serious RDP exploits of recent years (like BlueKeep) were patched months before mass exploitation. Keep automatic updates on; on a server, schedule them for a low-usage hour.
Final checklist
| Measure | What it protects against |
|---|---|
| Long, unique password | Brute force |
| NLA enabled | Pre-auth attacks |
| Changed port | Mass scan noise |
| IP-restricted access / VPN | All of the above |
| Updated Windows | Known exploits |
On a GINERNET Windows VPS you can apply this full checklist on day one: RDP ready out of the box, an external firewall manageable from the Manager and an emergency console to recover access if something goes wrong.