Securing RDP on a public IP: the four settings that matter

Exposing Remote Desktop Protocol (RDP) on a public IP is a default requirement for any self-managed Windows VPS. The protocol listens on TCP port 3389, and within minutes of being reachable from the internet, it will attract automated scanning and brute-force login attempts. Ignoring this exposure is not an option. The good news is that a handful of well-chosen settings stop the vast majority of attacks before they reach a credential prompt. This guide covers the four configuration changes that deliver the most protection per minute of effort. The environment assumed here is a Windows Server 2022 VPS running on a Windows VPS with full Administrator access, a dedicated IPv4, and unrestricted traffic.

公网RDP要开启NLA、锁定登录尝试并限制来源IP。

RDP on a public IP needs NLA, account lockout and source IP restriction.

Prerequisites

• A Windows VPS (Windows Server 2019 or 2022) with Administrator access.
• RDP connectivity already working, you can connect remotely.
• Firewall access (Windows Defender Firewall with Advanced Security on the VPS, plus any upstream firewall provided by your hosting environment).
• Knowledge of your current public IP address (the one you connect from, not the VPS IP).

Why RDP is a prime target on public IPs

RDP is one of the most frequently attacked services on the internet. Automated scanners probe the full IPv4 range for port 3389, then feed responding hosts into credential-stuffing tools that try common username-password pairs. A default Windows Server installation with a weak password can be compromised in minutes. The attack does not require sophistication, it is purely volumetric. Defending against it requires you to reduce the attack surface so that each authentication attempt carries a prohibitive cost for the attacker, or is blocked altogether before reaching the RDP service.

In Vietnam, hosting providers such as Viettel IDC, VNPT Data Center, FPT Telecom, and CMC Telecom operate Tier 3 datacenters that house the physical infrastructure for many local VPS services. A VPS provisioned in one of these facilities receives a dedicated IPv4 from the Vietnam IP range and domestic bandwidth that routes through local internet exchanges. This matters because the traffic between your Windows VPS and Vietnamese users stays inside the country, which reduces latency and avoids international transit bottlenecks. When you secure RDP on such a VPS, the same defensive principles apply as anywhere, the settings described here work identically whether the machine sits in Hanoi, Ho Chi Minh City, or any other location.

Setting 1, Enforce Network Level Authentication (NLA)

Network Level Authentication is not optional for RDP on a public-facing system. NLA requires the connecting client to authenticate before a full RDP session is established. Without NLA, the server allocates session resources as soon as a connection attempt arrives, even before credential validation. This opens a larger attack surface and consumes memory on the VPS for every failed attempt.

NLA is enabled by default on Windows Server 2022, but verify it manually:

Open Server Manager → Local Server → Remote Desktop → Advanced settings
→ Require use of Network Level Authentication to connect: Enabled

Alternatively, force it via Group Policy or the registry:

reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v UserAuthentication /t REG_DWORD /d 1 /f

Verify: Connect from a remote client that does not support NLA (or disable NLA support in your client temporarily). The connection should be rejected with a message stating that NLA is required.

Setting 2, Implement account lockout thresholds

Without an account lockout policy, an attacker can try thousands of password combinations across repetitive RDP connections. Windows Server permits this by default, the only limiting factor is network speed. Adding an account lockout policy stops brute-force attacks after a small number of failed attempts.

Configure it through the Local Security Policy (secpol.msc) or via the command line with the Net accounts tool:

# Set lockout threshold: 5 invalid attempts
net accounts /lockoutthreshold:5

# Set lockout duration: 15 minutes
net accounts /lockoutduration:15

# Reset counter after: 15 minutes
net accounts /lockoutwindow:15

These settings apply to all local accounts on the VPS, including the built-in Administrator. After 5 consecutive failed logins, the account is locked for 15 minutes. The lockout window (reset period) ensures the counter resets after 15 minutes of no failed attempts.

Verify: Intentionally enter the wrong password 5 times via RDP. The 6th attempt should return "The referenced account is currently locked out and may not be logged on to."

One important trade-off: if you also use this machine for automated scripts or services that authenticate via RDP or WinRM, those connections will also trigger the lockout. Either exclude service accounts by raising the threshold or use dedicated service accounts with separate lockout policies.

Setting 3, Restrict source IPs at the firewall

An account lockout stops brute-force attempts against credentials, but the RDP service remains visible to the entire internet. Every probe still consumes a minimal amount of CPU and network resources. To eliminate this noise, restrict RDP access to only the IP addresses or ranges from which you actually connect.

Use Windows Defender Firewall with Advanced Security:

Open wf.msc → Inbound Rules → locate "Remote Desktop (TCP-In)"
→ Right-click → Properties → Scope tab → Remote IP address
→ "Add these IP addresses" → enter your static IP or a CIDR range (e.g. 203.0.113.0/28)

If your own IP is dynamic, use a firewall rule that allows your country's IP range (e.g., Vietnam IP blocks assigned to Viettel, VNPT, FPT, CMC Telecom). This is a pragmatic compromise: it still blocks the vast majority of global scanners while accommodating a changing home IP. The rule is enforced before any packet reaches the RDP service, the attacker sees a silent drop or reject, not a live RDP banner.

Verify: Attempt an RDP connection from an IP outside the allowed range. The connection should time out or receive "Connection was denied" without ever prompting for credentials. From an allowed IP, normal authentication should proceed.

Note that this setting does not protect against a compromised client within the allowed range. Defense-in-depth still requires the previous two settings.

Setting 4, Use strong credentials and avoid the default Administrator

Password strength is still a first-order defense even with NLA and lockout policies. The lockout threshold means a user can be locked out after 5 attempts, but an attacker who guesses correctly on the 1st or 2nd try still gains access. Weak passwords (no special characters, common patterns like "Admin@123", or dictionary words) are routinely collected from breached datasets and used in credential-stuffing attacks.

Apply these rules:

• Avoid the built-in Administrator account entirely. Rename it via Local Security Policy → Local Policies → Security Options → "Accounts: Rename administrator account". Then create a separate local account with administrative privileges and a unique name.
• Use a password with at least 16 characters, mixing uppercase, lowercase, digits, and special characters. For a VPS managed by a single administrator, a passphrase (e.g., "Mountain-Coffee-Sky-22!") is both memorable and resistant to brute-force.
• Do not reuse any password that has appeared in a previous breach. Check against a service like Have I Been Pwned's password API, or generate a fresh one.
• Disable the Guest account if it is enabled.

Verify: After renaming the built-in Administrator, attempt an RDP login using the old "Administrator" name, it should fail. Confirm that the new administrative account can connect successfully and that its password passes a basic entropy test (at least 8 unique characters from 3 different character classes).

Troubleshooting common RDP security issues

• After enabling NLA, some clients cannot connect. Older RDP clients (pre-Windows 8 / Windows Server 2012) do not support NLA. Upgrade the client or use Remote Desktop Connection Manager (RDCMan) 2.8+. NLA itself is non-negotiable on a public-facing VPS, do not disable it for compatibility.
• Account lockout triggered by a legitimate service. If a scheduled task or monitoring tool runs under a local account and triggers lockouts, create a separate local account for that service, or increase the lockout threshold to 10 and the duration to 5 minutes.
• Firewall rule blocks all RDP, including your own IP. Connect via the VPS web console (IPKVM console) provided by your hosting provider. For thueVPS dedicated servers, the free IPKVM gives direct console access. From there, revert the firewall rule or add your correct IP.
• RDP port changed to a non-standard number. Changing port 3389 to something else reduces automated scanning noise, but it is not a substitute for the four settings above. Attackers now scan large port ranges, and a non-standard port adds only marginal security.

FAQ

Bài viết liên quan

• Hardening SSH on a new VPS: keys, ports, fail2ban and CrowdSec
• Set up nftables firewall on a VPS to replace iptables
• User and sudo permissions management on Linux VPS
• Secure RDP configuration for Windows VPS
• Security audit and hardening with Lynis on a VPS