Put a Windows server on the internet and automated scanners will find it within hours. They try thousands of common usernames and passwords over Remote Desktop, around the clock. The good news is that a few settings, all built into Windows Server, stop almost all of it. Work through these ten steps once and your VPS will be in better shape than most servers online.
1. Use a long, unique Administrator password
This is the most important step. Use at least 16 random characters and never reuse a password from another site. Our free password generator makes one in a click. To change it, press Ctrl + Alt + End inside your RDP session and choose Change a password. Keep it in a password manager.
2. Create your own admin account
Every attacker tries the username Administrator first. Create a second account with a less obvious name, add it to the Administrators group, and use it for daily work. In an administrator command prompt:
net user yourname * /addnet localgroup Administrators yourname /add
The * makes Windows ask for the new password, so it never appears on screen. Sign in with the new account to test it. Once it works, you can rename the built-in account in secpol.msc under Local Policies, Security Options, "Accounts: Rename administrator account".
3. Allow RDP only from your IP address
This one setting blocks every bot on the internet. Find your address with our My IP tool, then:
- Open Windows Defender Firewall with Advanced Security (
wf.msc). - Under Inbound Rules, open Remote Desktop - User Mode (TCP-In).
- On the Scope tab, under Remote IP address, choose These IP addresses and add yours. Repeat for the UDP rule.
Careful: if your home IP changes, you will lock yourself out. Add a second address you trust, such as an office or a VPN, and remember that the console in your client area still works if you need to undo the change. If your IP changes often, skip this step and lean on steps 1, 5 and 6 instead.
4. Keep Network Level Authentication on
Network Level Authentication (NLA) makes users sign in before a full session is created. That saves server resources and closes off a whole class of attacks. It is on by default. Check it under System Properties, Remote: "Allow connections only from computers running Remote Desktop with Network Level Authentication" should be ticked.
5. Set an account lockout policy
Lockout stops endless password guessing. In secpol.msc, go to Account Policies, Account Lockout Policy, and set a threshold of around 10 invalid attempts with a 15 minute lockout. Brute force becomes painfully slow, while a typo or two never locks you out for long. Windows treats the built-in Administrator account specially here, which is one more reason to work from your own account from step 2.
6. Keep Windows Update on
Many break-ins use holes that were patched months earlier. Leave automatic updates enabled, install the monthly cumulative update within a week or two of release, and schedule restarts for a time when you are not working.
7. Leave Microsoft Defender running
Windows Server includes Microsoft Defender Antivirus, and it is on by default. Do not turn it off to "save resources". If it flags a program you trust, add a specific exclusion instead of disabling protection.
8. Close every port you do not use
Each open port is a door. Review your inbound firewall rules and disable anything you did not deliberately open. Then test from the outside with our port checker: only RDP and the ports your applications need should answer.
9. Watch for failed logins
Windows logs every failed sign-in as Event ID 4625. To list the most recent ones, run this in PowerShell as administrator:
Get-WinEvent -FilterHashtable @{LogName='Security';Id=4625} -MaxEvents 20 | Select-Object TimeCreated
A handful a day is normal internet noise. Hundreds an hour means you are being targeted, and step 3 becomes urgent.
10. Back up what matters
Security also means recovering when something goes wrong: ransomware, a bad update, a deleted folder. Keep copies of important data off the server and test a restore at least once. Our guide on how to back up a VPS covers the options.
What about changing the RDP port?
Moving RDP from port 3389 to another port cuts the volume of automated attempts and keeps your logs cleaner. It does not stop a determined attacker, who can scan every port in minutes, so treat it as an extra and not a replacement for the steps above. If you do it, add a firewall rule for the new port before you change the port number in the registry (HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp, value PortNumber), then restart. Otherwise you will lock yourself out.
The 10-minute version
Short on time? Do steps 1, 3 and 6 today. A strong password, RDP limited to your IP and automatic updates handle the vast majority of real-world attacks. Every Volt Serv Windows VPS gives you full Administrator access to set all of this up. New to Remote Desktop? Start with how to connect to a Windows VPS. Running Linux too? See our Linux VPS security guide.