Remote Desktop Protocol (RDP) is a powerful feature built into Windows that lets you control a computer from anywhere in the world. However, if left exposed, it becomes a favorite target for attackers. This guide walks you through a secure, intermediate‑level setup that hardens RDP while keeping it easy to use. By the end, you’ll have a locked‑down remote desktop environment you can trust.
What You’ll Need
- A Windows 10/11 Pro, Enterprise, or Server machine (RDP is disabled on Home editions).
- Administrator access on the host computer.
- A static IP address or a dynamic DNS service (e.g., No-IP, DuckDNS) if you plan to connect over the internet.
- An active firewall – Windows Defender Firewall is sufficient, but a hardware firewall adds extra layers.
- Optional: A VPN solution (OpenVPN, WireGuard, or a commercial service) for an added security tunnel.
Step 1: Enable Remote Desktop Safely
Open Settings → System → Remote Desktop. Toggle Enable Remote Desktop to On. When prompted, click Confirm. Windows will automatically add a firewall rule for RDP on the private network profile, but not on public networks. Click Advanced settings and make sure the rule is enabled for the profile(s) you intend to use. For a tighter lock, change the default listening port (default is 3389) by editing the registry:
reg add "HKLMSystemCurrentControlSetControlTerminal ServerWinStationsRDP-Tcp" /v PortNumber /t REG_DWORD /d 3390 /f
After the change, restart the Remote Desktop Services (or reboot) for the new port to take effect.
Step 2: Restrict RDP Access with Windows Firewall
Open Windows Defender Firewall with Advanced Security. Create a new inbound rule:
- Rule Type: Port
- Protocol: TCP, Specific local ports: 3390 (or your custom port)
- Action: Allow the connection
- Profile: Check only the profiles you use (Domain, Private). Leave Public unchecked.
- Name: Secure RDP (Custom Port)
Next, add a second rule that blocks the default 3389 port on all profiles to prevent accidental exposure:
netsh advfirewall firewall add rule name="Block RDP Default Port" dir=in action=block protocol=TCP localport=3389
This double‑layer ensures only the port you specified is reachable.
Step 3: Enforce Network Level Authentication (NLA)
NLA requires users to authenticate before a remote session is created, dramatically reducing the attack surface. In the same Remote Desktop settings page, verify that Require computers to use Network Level Authentication to connect is checked. You can also enforce it via Group Policy:
gpedit.msc → Computer Configuration → Administrative Templates → Windows Components → Remote Desktop Services → Remote Desktop Session Host → Security → Require user authentication for remote connections by using Network Level Authentication – set to Enabled.
If you manage multiple machines, deploy this policy through Active Directory for consistency.
Step 4: Configure Strong Authentication
RDP relies on Windows credentials, so strong passwords are a must. Enforce password complexity:
gpedit.msc → Computer Configuration → Windows Settings → Security Settings → Account Policies → Password Policy → Enforce password history (24), Minimum password length (12), Password must meet complexity requirements (Enabled).
For an extra layer, enable Multi‑Factor Authentication (MFA) using Azure AD or a third‑party solution like Duo. With Azure AD, assign the “Require MFA” conditional access policy to the user accounts that will log in via RDP.
Step 5: Set Up a VPN Tunnel (Highly Recommended)
Exposing RDP directly to the internet is risky, even with a custom port and NLA. A VPN creates an encrypted tunnel, making the RDP service appear as if it’s on a local network. Install a lightweight OpenVPN server on the host or on a dedicated gateway:
# Install OpenVPN (Windows Server example)
choco install openvpn
Generate server and client certificates, configure server.ovpn to push the host’s internal IP, and then connect your remote device using the generated .ovpn file. Once the VPN is active, you can connect to the Windows machine using its internal IP address and the custom RDP port.
Step 6: Harden the RDP Service with Security Policies
Limit which users can log in via RDP. In System Properties** → **Remote** tab, click **Select Users…** and add only the required accounts. For domain environments, use Group Policy to restrict the Remote Desktop Users group:
Computer Configuration → Policies → Windows Settings → Security Settings → Local Policies → User Rights Assignment → Allow log on through Remote Desktop Services – add only your admin accounts.
Disable clipboard redirection and drive mapping if they’re not needed, as they can be used to exfiltrate data. These settings live under:
Computer Configuration → Administrative Templates → Windows Components → Remote Desktop Services → Remote Desktop Session Host → Device and Resource Redirection
Set Do not allow clipboard redirection and Do not allow drive redirection to Enabled.
Step 7: Keep the System Updated and Monitor Logs
Apply Windows updates promptly, especially patches related to RDP (e.g., CVE‑2020‑0609, CVE‑2020‑0605). Enable automatic updates or use WSUS for centralized control. Additionally, enable logging for RDP events:
Event Viewer → Applications and Services Logs → Microsoft → Windows → TerminalServices‑RemoteConnectionManager → Operational
Set up a scheduled task that emails you when a failed login attempt occurs, or forward logs to a SIEM for real‑time analysis.
Common Mistakes to Avoid
1. Leaving the default 3389 port open – attackers scan this port relentlessly. Always change it and block the default.
2. Disabling Network Level Authentication – it’s a simple, effective barrier. Never turn it off for convenience.
3. Using weak passwords – RDP brute‑force tools are plentiful. Enforce complexity and MFA.
4. Allowing RDP on public networks – only enable the firewall rule for private or domain profiles.
5. Neglecting VPN or other tunneling – direct exposure dramatically raises risk, even with hardening.
Tips and Tricks
• Use a jump host: Deploy a hardened Windows machine that only accepts VPN connections, then RDP into internal servers from there.
• Limit login attempts with the “Account lockout threshold” policy to thwart credential stuffing.
• Enable Remote Desktop Gateway (RD Gateway) for an HTTPS‑wrapped RDP session, which adds SSL encryption without a full VPN.
• Regularly audit the Remote Desktop Users group to ensure no orphaned accounts linger.
Frequently Asked Questions
Is changing the RDP port enough to secure it?
Changing the port is security‑through‑obscurity. It reduces automated scans but does not replace NLA, strong passwords, firewall rules, or a VPN. Treat it as a supplementary measure.
Can I use RDP on Windows Home edition?
Home editions lack the built-in Remote Desktop server. You can use third‑party tools like TeamViewer or enable “Remote Assistance,” but for true RDP you need Pro, Enterprise, or Server editions.
What’s the performance impact of routing RDP through a VPN?
Modern VPN protocols (WireGuard, OpenVPN UDP) add minimal latency—typically under 10 ms on a decent broadband connection. The security benefits far outweigh the slight performance dip.
Conclusion
Securing Remote Desktop on Windows is a balance of proper configuration, strong authentication, and network isolation. By following the steps above—enabling NLA, changing the default port, tightening firewall rules, enforcing robust passwords, and, ideally, tunneling through a VPN—you dramatically lower the risk of unauthorized access while keeping the convenience of remote work. Remember to review logs regularly and keep your system patched. With these practices in place, you can confidently access your Windows machine from anywhere, knowing it’s protected against the most common RDP threats.
