Windows

Set up a stable Windows Server 2022 RDP VPS in Vietnam

BM BizMaC Team Sep 04, 2026 12 min read

Setting up a Windows Server 2022 RDP VPS in Vietnam that stays stable for remote teams is a different beast from the usual Linux tutorial. You are fighting three things at once: network latency on international links, RDP's own sensitivity to packet loss, and the security noise that every public Windows box attracts. When a developer in Ho Chi Minh City connects to a colleague in Da Nang and the session freezes every few seconds, the culprit is rarely the VPS itself. It is almost always the TCP stack, the RDP keepalive settings, or a misconfigured router. This guide walks through the exact configuration that keeps a Windows VPS in Vietnam responsive for daily remote work.

  • Key takeaways:
  • RDP uses TCP port 3389 by default. Keep it there unless you have a strong reason to move it, then update the firewall rules in the same step.
  • Set KeepAliveInterval and KeepAliveTime in the registry to prevent idle disconnects over domestic or international links.
  • Network Level Authentication (NLA) is non-negotiable on a public IP. It blocks most credential brute-force traffic before it reaches the login screen.
  • If latency from China or Southeast Asia sits above 80 ms, enable the EnableWDDM and EnableFrameServerMode policies to smooth video and remote desktop rendering.

Prerequisites

  • A Windows Server 2022 VPS with a public IPv4. The one we reference runs on a Windows Server VPS RDP with KVM virtualization and full Administrator access.
  • Local Administrator credentials. You should not be running day-to-day work as Administrator, but the setup steps require it.
  • Optional but recommended: a static public IP for the office or home network that will connect to this VPS.
  • Familiarity with Remote Desktop Connection (mstsc.exe) on Windows, or a client like Microsoft Remote Desktop on macOS or Linux.

You do not need a domain controller, Active Directory, or any enterprise licensing to follow this guide. A standalone Windows Server 2022 installation works fine for a remote team of 5 to 20 people connecting through RDP.

Why a Vietnam-based Windows RDP VPS makes sense for local teams

Latency is the deciding factor for RDP responsiveness. A session feels "stable" when round-trip time stays under 50 ms, and becomes noticeably sluggish above 100 ms. If your team is physically in Vietnam, hosting the Windows Server 2022 RDP VPS in a Vietnam datacenter cuts the network path dramatically compared to a Singapore or Hong Kong box. Domestic routing between Hanoi, Da Nang, and Ho Chi Minh City is mostly direct over Viettel, VNPT, FPT, or CMC backbone links, whereas an offshore server forces every frame through international gateways.

There is a second, less obvious advantage: a Vietnam Windows VPS with a dedicated IPv4 gives you a local presence for compliance and troubleshooting. When a client or partner in Vietnam needs to access an internal tool, the connection stays inside the country. For teams that also manage Linux infrastructure, the same provider often offers both platforms, which simplifies billing and support when something breaks at 2 a.m.

越南 VPS 提供本地 IPv4 和低延迟，适合面向越南用户的远程桌面业务。

A Vietnam VPS gives you a local IPv4 and low latency, which suits remote desktop work for users inside Vietnam.

Step 1 - Lock down RDP security before opening port 3389

Every Windows Server on a public IP gets scanned within minutes. Bots probe port 3389 constantly, trying default credentials and known exploits. The first thing you do after the OS finishes installing is reduce that attack surface. Do not open the firewall rule for RDP until these settings are in place.

Open an elevated PowerShell session on the server and run the following to confirm Network Level Authentication is enforced:

reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v UserAuthentication /t REG_DWORD /d 1 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v SecurityLayer /t REG_DWORD /d 2 /f

SecurityLayer 2 forces TLS 1.0 or higher between client and server, and UserAuthentication 1 requires the user to authenticate before a session is created. These two values block a large share of brute-force attacks that never complete the TLS handshake.

Next, rename the local Administrator account and create a separate admin user for daily work:

Rename-LocalUser -Name "Administrator" -NewName "adm_vn_01"
New-LocalUser -Name "devops" -Password (ConvertTo-SecureString "UseAStrongPassphrase#2026" -AsPlainText -Force) -FullName "DevOps User"
Add-LocalGroupMember -Group "Administrators" -Member "devops"

Verify the changes took effect:

Get-LocalGroupMember -Group "Administrators"

Expected output lists adm_vn_01 and devops as members. Now, when you configure the firewall in the next step, you allow RDP from specific source IPs rather than from anywhere.

Restrict RDP source IPs with Windows Firewall

The single most effective control is limiting which source addresses can reach port 3389. If your team connects from a fixed office IP, create an inbound rule that only allows that subnet. For teams with dynamic home IPs, use a VPN or a jump host instead of exposing RDP broadly.

Remove-NetFirewallRule -DisplayName "Remote Desktop - Default" -ErrorAction SilentlyContinue
New-NetFirewallRule -DisplayName "RDP - Office Only" -Direction Inbound -Protocol TCP -LocalPort 3389 -RemoteAddress "203.162.10.0/24" -Action Allow
New-NetFirewallRule -DisplayName "RDP - Team VPN" -Direction Inbound -Protocol TCP -LocalPort 3389 -RemoteAddress "10.8.0.0/24" -Action Allow

In this example, 203.162.10.0/24 is the office public range and 10.8.0.0/24 is the WireGuard or OpenVPN subnet your team uses for remote access. If you only need the office range, drop the VPN rule. Verify the rules are active:

Get-NetFirewallRule -DisplayName "RDP - *" | Select-Object DisplayName, Enabled, Direction

Both rules show Enabled: True. This firewall policy is the difference between a server that logs hundreds of failed logins per hour and one that stays quiet for weeks.

Step 2 - Tune the TCP stack and RDP registry for stable sessions

Windows Server 2022 defaults are tuned for data centers with low latency, not for RDP sessions crossing domestic backbones or international links from China or Southeast Asia. The registry values below adapt the TCP stack to a high-latency, moderate-loss environment. Run these in the same elevated PowerShell session.

reg add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v KeepAliveTime /t REG_DWORD /d 30000 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v KeepAliveInterval /t REG_DWORD /d 1000 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v KeepAliveTimeout /t REG_DWORD /d 1 /f

KeepAliveTime 30000 (30 seconds) tells TCP to probe the peer when no data has been sent, instead of waiting the default two hours. KeepAliveInterval 1000 sets the retry period to one second. Together they keep NAT firewalls from silently dropping the idle RDP connection, which is the main cause of "the session just froze" complaints in Vietnam where carrier-grade NAT is common on home fiber.

Now tune RDP itself for responsiveness:

reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v MaxIdleTime /t REG_DWORD /d 0 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v MaxConnectionTime /t REG_DWORD /d 0 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v DisableRemoteDesktopLPE /t REG_DWORD /d 1 /f

MaxIdleTime 0 and MaxConnectionTime 0 disable session timeout, which is what you want for a developer who leaves a build running overnight. The DisableRemoteDesktopLPE flag addresses the CredSSP remote code execution family of vulnerabilities from 2018, and it is still worth setting explicitly on older images.

Apply the changes by restarting the Remote Desktop service. This disconnects active sessions, so do it during a maintenance window:

Restart-Service TermService -Force

Verify the service is running:

Get-Service TermService | Select-Object Status, StartType

Expected result: Status: Running, StartType: Automatic.

Step 3 - Configure the RDP session experience for low bandwidth

The default RDP experience profile assumes a LAN with ample bandwidth. For a team connecting from home fiber, or from China where international routing adds latency, you want the session to prioritize input responsiveness over visual polish. Set these Group Policy values on the server.

Open gpedit.msc and navigate to Computer Configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Remote Session Environment. Enable the following policies:

  • Use the hardware graphics adapter for all Remote Desktop Services sessions - Enabled. This offloads rendering to the vGPU if available, or uses optimized software paths.
  • Prioritize H.264/AVC 444 graphics mode for Remote Desktop connections - Enabled. This applies to Windows 10/11 clients and improves video playback inside the session.
  • Enable RemoteFX encoding for RemoteFX clients - Disabled. RemoteFX is deprecated, and keeping it disabled avoids compatibility warnings on modern clients.

For teams that run browser-based tools or legacy client-server apps inside the session, the single largest win is disabling the desktop wallpaper and visual effects at the client level. Instruct users to open Remote Desktop Connection, go to the Experience tab, and select LAN (10 Mbps or higher) with the following checkboxes cleared: Desktop wallpaper, Font smoothing, and Show window contents while dragging.

# Verify the session-level policy applied
gpresult /r | Select-String "Remote Session Environment"

This takes 30 seconds per user and cuts bandwidth consumption per session by roughly a third. If your team connects from China through a less stable international route, also enable compression on the RDP-Tcp properties under Remote Desktop Session Host > Connections > RDP-Tcp > Properties, set to Balanced or Compress more.

Step 4 - Keep the system patched and monitor for brute force

Windows Update on a server should never be set to automatic-and-reboot. That is how a long-running batch job dies at 3 a.m. Configure active hours, or better, a manual approval workflow. In PowerShell, set the Windows Update service to manual start and schedule a weekly task that installs updates and reboots only when the server is idle.

Set-Service -Name wuauserv -StartupType Manual
schtasks /Create /TN "WeeklyPatch" /TR "powershell -Command Install-WindowsUpdate -AcceptAll -AutoReboot" /SC WEEKLY /D SUN /ST 02:00 /RU SYSTEM /F

This assumes the PSWindowsUpdate module is installed. If it is not, install it once:

Install-Module PSWindowsUpdate -Force -Confirm:$false

Monitor the security log daily. The event ID to watch is 4625 (failed logon). A healthy, well-firewalled server shows near zero of these. If you see hundreds, your source-IP restriction is misconfigured:

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625} -MaxEvents 10 | Select-Object TimeCreated, Message | Format-List

You can also integrate the Windows security log into a Linux-based monitoring stack if you run one, but that is a topic for another post on VPS server monitoring tools and strategies for 2026.

Step 5 - Test the connection and measure latency from different cities

Before you roll the server out to the team, measure what they will actually experience. From a Windows client, use ping and a TCP port check to the VPS public IP:

ping -t 203.162.10.25
Test-NetConnection 203.162.10.25 -Port 3389

Interpret the results like this:

  • Ping under 20 ms from Hanoi to a Hanoi-based VPS: excellent, expect a near-lan RDP feel.
  • Ping under 60 ms from Ho Chi Minh City to a Hanoi VPS: good, RDP is fully usable including video.
  • Ping above 100 ms from any domestic location: chase the route, it likely leaves Vietnam and comes back.

For an actual session quality test, connect with RDP and run this inside the session:

Get-Counter '\Terminal Services\Total Session Bytes Received' -SampleInterval 1 -MaxSamples 5

Watch the delta between samples. If bytes received are choppy (large spike then near zero), you have packet loss, not bandwidth. The fix is usually on the client side: switch from Wi-Fi to Ethernet, or ask the ISP about the international route. If the server is on a cheap VPS Vietnam plan with shared international bandwidth, expect periodic slowdowns outside domestic hours.

Why does my RDP connection keep dropping after a few minutes of inactivity?

This is the most common complaint we see on Windows Server 2022 RDP VPS setups in Vietnam. The cause is nearly always an idle timeout imposed somewhere between the client and the server: the local router's NAT table, the ISP's carrier-grade NAT, or the RDP session itself. The registry values in Step 2 (KeepAliveTime and KeepAliveInterval) keep TCP probing the peer so NAT entries do not expire. If the problem persists, check whether a network device on the client side applies an application-level timeout to RDP traffic specifically.

What is the best Windows Server edition for a small remote team RDP VPS?

Windows Server 2022 Standard is the right choice for most teams of up to 50 users. It supports up to 24 cores and two virtual machines, and the RDP licensing for remote work is covered under User CALs or the built-in two-device limit for administrative use. If you only need five concurrent sessions for light tasks, the Essentials edition that some providers bundle is cheaper, but it is capped at 25 users and lacks some clustering features. For a production setup, go Standard and buy the correct number of User CALs. Always confirm with the Windows VPS provider whether RDP is allowed on the plan or whether you need to supply your own licensing.

Is RDP over the public internet safe if I have a strong password?

No. A strong password slows down brute force but does not stop it, and it does nothing against credential-stuffing attacks that use passwords leaked from other breaches. The effective combination is: Network Level Authentication enabled, RDP access restricted by source IP in Windows Firewall, and the local Administrator account renamed. For teams connecting from dynamic home IPs, the right architecture is a VPN into the VPS first, then RDP only over that private tunnel. This follows the same logic as secure RDP configuration for Windows VPS and applies to any public-facing server.

Related articles

越南 Windows Server 2022 RDP 配置要点

为越南远程团队配置稳定的 Windows Server 2022 RDP VPS，关键是三步：首先启用网络级身份验证并限制防火墙只允许办公网或 VPN 源 IP 访问 3389 端口；其次通过注册表调整 TCP 保活参数，防止空闲连接被运营商 NAT 中断；最后在组策略中启用硬件图形适配和 H.264/AVC 444 模式来优化低带宽下的体验。架设在越南本地机房的 VPS 能显著降低国内延迟，实测河内到胡志明市延迟通常低于 60 毫秒，适合日常远程办公。

Note: This guide is for general reference. Every system and infrastructure has its own specifics, so test each step in a safe environment and consult a qualified engineer before applying it in production.