The 12-point checklist for securing a Windows RDP server

The threat is automated, not personal

We instrumented a fresh Windows instance on a clean IPv4 in June 2026. First inbound connection attempt on 3389: 4 minutes 11 seconds after boot. First credential guess: 9 minutes. In 24 hours it logged 41,700 authentication attempts from 2,300 unique sources. Nobody targeted that server — it was found by a mass scanner, as every exposed 3389 is.

Everything below assumes you are the administrator of the machine, which on any RDPForge plan you are.

Tier 1 — do these in the first ten minutes

1. Move RDP off port 3389

It does not stop a determined attacker, but it removes you from every mass scan list that only checks 3389. Change the registry value, add the firewall rule, then reboot:

Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name PortNumber -Value 53389
New-NetFirewallRule -DisplayName "RDP-Custom" -Direction Inbound -Protocol TCP -LocalPort 53389 -Action Allow
Restart-Computer

Connect afterwards with your.ip:53389. Do not remove the old rule until you have confirmed the new port works.

2. Restrict RDP to known source IPs

The single highest-impact control. If your ISP gives you a static address, scope the rule to it:

Set-NetFirewallRule -DisplayName "RDP-Custom" -RemoteAddress 203.0.113.44

On a dynamic address, scope to your ISP's allocation block instead, or put a WireGuard tunnel in front and allow RDP only from the tunnel subnet. Our knowledge base has a copy-paste WireGuard setup that takes about ten minutes.

3. Rename Administrator and use a passphrase

Half of all brute-force traffic assumes the username is Administrator. Renaming it makes attackers guess two unknowns instead of one:

Rename-LocalUser -Name "Administrator" -NewName "atlas_ops"

Then set something long. Four unrelated words with separators beats P@ssw0rd! by orders of magnitude and is easier to type over a laggy session. Replace whatever we emailed you at first login — that credential travelled by email and should be treated as burned.

Tier 2 — do these in the first hour

4. Enable Network Level Authentication

NLA forces authentication before a session is created, which blocks pre-auth exploits and cuts the CPU cost of brute-force attempts. On by default in our images; verify it survived any GPO you applied:

Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name UserAuthentication -Value 1

5. Account lockout policy

Ten failures, fifteen-minute lockout. Enough to defeat automation, not enough to lock yourself out for the day:

net accounts /lockoutthreshold:10 /lockoutduration:15 /lockoutwindow:15

6. Turn off the accounts you are not using

Guest and DefaultAccount should be disabled. Audit what exists, because installers sometimes add service accounts you did not ask for:

Get-LocalUser | Where-Object Enabled -eq $true | Select-Object Name, LastLogon

7. Patch, then keep patching

BlueKeep (CVE-2019-0708) and the 2022 RD Gateway RCEs both had patches out before mass exploitation. Set a maintenance window and let updates install:

Install-Module PSWindowsUpdate -Force
Get-WindowsUpdate -Install -AcceptAll -AutoReboot

Tier 3 — the difference between "fine" and "hardened"

8. Enforce TLS 1.2+ and disable legacy ciphers

Kill SSL 3.0, TLS 1.0 and 1.1 at the SCHANNEL level. Our KB article Hardening SCHANNEL on Windows Server has the full registry script.

9. Audit logon events and actually read them

auditpol /set /subcategory:"Logon" /success:enable /failure:enable
Get-WinEvent -FilterHashtable @{LogName='Security';ID=4625} -MaxEvents 50 |
  Group-Object -Property {$_.Properties[19].Value} | Sort-Object Count -Descending

That last command ranks failed logons by source IP. A single address with thousands of attempts is a firewall rule waiting to be written.

10. Disable clipboard and drive redirection if you do not need them

Redirected drives are a two-way path between your laptop and a server you might be sharing. Under gpedit.msc → Computer Configuration → Administrative Templates → Windows Components → Remote Desktop Services → Device and Resource Redirection, disable what you do not use.

11. Take backups you have actually tested

Ransomware operators specifically hunt exposed RDP. Nightly image snapshots with 7 restore points cost $2-8/month on our plans and are the only control that reliably turns a catastrophe into an afternoon. Restore one on purpose, once, so you know the procedure before you need it.

12. Put a gateway in front for multi-user setups

Beyond three or four users, stop exposing RDP directly. An RD Gateway terminates TLS on 443, or a WireGuard/Tailscale mesh removes the public listener entirely. Either way there is nothing on the public internet to brute-force.

Fifteen-minute verification

# Which ports are actually listening?
Get-NetTCPConnection -State Listen | Select-Object LocalAddress, LocalPort, OwningProcess

# Firewall profiles all on?
Get-NetFirewallProfile | Select-Object Name, Enabled

# Failed logons in the last 24 h
(Get-WinEvent -FilterHashtable @{LogName='Security';ID=4625;StartTime=(Get-Date).AddDays(-1)}).Count

If that last number is in the thousands after you have applied Tier 1, your firewall rule is not doing what you think it is. Re-check the source-IP scope.