How to secure RDP on a Windows VPS: NLA, lockout and an IP allowlist

An RDP port that answers the whole internet gets password guesses within minutes of the server coming up. A long password alone holds, but every guess still costs a logon attempt, fills the event log and gives the next RDP bug something to talk to. Five steps fix that. Each one is a PowerShell command, and each was run on our Windows Server 2022 image before publishing.

Open PowerShell as Administrator over RDP (how to connect) and go in order. Do step 4 last: it's the one that can lock you out.

1. Use a long, unique password

If you're still on the password from the first login, change it in the dashboard to something long (20+ characters, from a password manager). Every step below assumes the password itself isn't guessable.

2. Turn on Network Level Authentication

With NLA, Windows checks your credentials before it creates a session and draws a login screen. Unauthenticated connections never reach the desktop code, which is where most historical RDP bugs lived. Check the current state:

(Get-CimInstance -Namespace root/cimv2/TerminalServices -ClassName Win32_TSGeneralSetting -Filter "TerminalName='RDP-tcp'").UserAuthenticationRequired

1 means NLA is on. If you see 0, turn it on:

Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name UserAuthentication -Value 1

Current Remote Desktop clients on Windows, macOS and Linux (xfreerdp) all support NLA. Your next connection asks for the password before the remote screen appears.

3. Lock accounts after failed attempts

A default Windows Server 2022 install never locks an account, no matter how many wrong passwords arrive. Servers installed from our image since October 24, 2026 already have the limit below; on older ones, set it:

net accounts /lockoutthreshold:5 /lockoutwindow:15 /lockoutduration:15
net accounts

Five wrong passwords within 15 minutes lock the account for 15 minutes. We tested it: after five bad attempts both a normal user and the built-in Administrator were locked. The lock lifts on its own, so a typo-heavy morning costs you a quarter of an hour, not the server.

4. Allow RDP only from your IP address

This step removes almost all of the noise. Windows Firewall rules accept a list of remote addresses; set it to yours. Find your current public IP on any "what is my IP" page, then:

$myIp = '203.0.113.10'   # your public IP; several: '203.0.113.10','198.51.100.0/24'
Get-NetFirewallPortFilter | Where-Object LocalPort -eq 3389 | Get-NetFirewallRule | Set-NetFirewallRule -RemoteAddress $myIp

That command finds every inbound rule on port 3389, not just the built-in "Remote Desktop" group. This matters: servers installed from our image before October 24, 2026 have an extra rule named "EQVPS RDP 3389" that opens the port to everyone, and other software can add its own. If you restrict only the built-in group, such a rule keeps the port open. We made exactly that mistake while testing. Check the result:

Get-NetFirewallPortFilter | Where-Object LocalPort -eq 3389 | Get-NetFirewallRule |
  Select-Object DisplayName, @{n='Remote';e={($_ | Get-NetFirewallAddressFilter).RemoteAddress}}

Every line should show your address. In our test, a connection from any other address timed out, and the allowed one went through.

On a NAT plan this works the same way. The forward from your personal port keeps your real address, so allow your own public IP.

If your IP changes, RDP stops answering you too. Open the browser console from the dashboard (it doesn't go through RDP or the firewall), log in, and run the command with the new address. To undo the allowlist completely, use -RemoteAddress Any.

5. See who is trying to get in

Failed logons are event 4625 in the Security log. This shows the account name and the address each attempt came from:

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625} -MaxEvents 20 |
  Select-Object TimeCreated, @{n='User';e={$_.Properties[5].Value}}, @{n='SourceIP';e={$_.Properties[19].Value}}

Before the allowlist, expect a steady stream of Administrator, admin, user from addresses you don't know. After it, the list should go quiet.

What not to bother with

• Changing the RDP port. On a plan with its own IPv4 it only reduces log noise; scanners find the new port quickly. On a NAT plan it breaks your access, because the forward goes to 3389.
• Turning the firewall off "to make it work". If RDP stops answering after a rule change, fix the rule from the browser console.

Keep it updated

Most serious RDP incidents came from protocol bugs, not passwords. Windows Server 2022 receives security updates until October 14, 2031, so leave Windows Update on and restart when it asks.

The image is Windows Server 2022 with your own licence (how BYOL works). Plans start at Windows-Small: 4 vCPU, 4 GB RAM, 50 GB, $11/mo on NAT. With its own IPv4, Windows Small-IP is $28/mo. All four plans are on the Windows VPS page. For SSH next to RDP, see OpenSSH on Windows Server.