First 30 Minutes on a New Windows RDP Server: A Hardening Checklist

A Windows server with Remote Desktop open to the internet starts getting password guesses within hours of going online. Bots scan the whole IPv4 range for port 3389 and try Administrator with every leaked password they have. None of this is targeted at you, which is exactly why the basics stop most of it.

Here's the checklist I run on any fresh Windows RDP box before installing a single app. It takes about half an hour and needs nothing beyond what ships with Windows.

1. Patch before anything else

Open Windows Update, install everything, reboot, and check again. Fresh images are often a few months behind, and RDP-related vulnerabilities have been some of the most exploited Windows bugs of the last few years. Don't put this off until "after setup".

2. Stop using the built-in Administrator account

Every brute-force tool tries Administrator first. Create your own admin account with a long passphrase (16+ characters, never reused anywhere):

$pw = Read-Host -AsSecureString "Password"
New-LocalUser -Name "opsadmin" -Password $pw -PasswordNeverExpires
Add-LocalGroupMember -Group "Administrators" -Member "opsadmin"

Sign out, connect again as the new account, and only once that works, disable the built-in one:

Disable-LocalUser -Name "Administrator"

Use a name that isn't obvious. admin, user and your company name are all on the guess lists.

3. Turn on account lockout

By default, Windows lets an attacker keep guessing. A lockout policy slows them down to a crawl:

net accounts /lockoutthreshold:5 /lockoutwindow:30 /lockoutduration:30

That locks an account for 30 minutes after 5 bad passwords within 30 minutes. You can set the same thing in secpol.msc under Account Policies > Account Lockout Policy. Run net accounts afterwards to confirm the values stuck.

4. Make sure Network Level Authentication is on

With NLA, the client has to authenticate before Windows builds a full login session, which cuts the load from bots and blocks some pre-login attacks. It's on by default on current Windows, but images and old guides sometimes switch it off. Check it in System Properties > Remote ("Allow connections only from computers running Remote Desktop with Network Level Authentication"), or from PowerShell:

Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name UserAuthentication

A value of 1 means NLA is required. If it's 0, set it back:

Set-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name UserAuthentication -Value 1

5. Limit who can reach the port (only if your IP is static)

If you always connect from an office with a fixed IP, tell Windows Firewall to accept RDP from that address only:

Set-NetFirewallRule -DisplayGroup "Remote Desktop" -RemoteAddress 203.0.113.10

Replace the example address with yours. Be careful here: if your home or office IP changes, this rule locks you out too. If your connection uses a dynamic IP, skip this step and rely on the lockout policy and a strong passphrase.

About changing the RDP port: it cuts log noise but it isn't real security, and some hosted plans only open the standard RDP port upstream. Check with your provider before you touch it.

6. Look at who's knocking

Failed logons are logged as event ID 4625 in the Security log. A quick look tells you whether the bots have found you yet:

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625} -MaxEvents 20 |
  Select-Object TimeCreated, @{n='Account';e={$_.Properties[5].Value}}, @{n='Source';e={$_.Properties[19].Value}}

If you see hundreds of attempts against names like admin or test, the lockout policy and the renamed admin account are doing their job. If you see attempts against your real admin name, that name has leaked somewhere, so change it along with the password.

7. Treat it as a server, not a laptop

• Keep Microsoft Defender on and check it with Get-MpComputerStatus (look for RealTimeProtectionEnabled : True).
• Don't browse random sites or open email attachments on the server. Most "my RDP got hacked" stories start with a download, not a brute-forced password.
• Give each person their own login instead of sharing one admin password over chat, and remove accounts the day someone stops needing them.
• Keep copies of important files somewhere other than the server itself.

8. Write down what you changed

A short note with the admin account name, the lockout settings and any firewall rules saves a lot of guesswork six months later, especially when someone else has to log in.

Where to run it

All of this works on any Windows machine you can reach over RDP. If you want a remote Windows desktop without buying hardware, ShoHost's Private Admin RDP plans let you install any Windows OS with admin access. Plans start at 2 vCore, 2 GB RAM and 50 GB SSD and go up to 8 vCore with 16 GB RAM, all on a 200 Mbps port with unlimited bandwidth. Only the RDP port is open, which suits a remote desktop but not a public web server. The entry plan comes to ₹410.97 a month, all fees included. Questions before you order? Write to [email protected] or WhatsApp +91 94880 91432, 9 AM to 12 midnight IST.