If you have a Windows machine with [Remote Desktop](https://ginernet.com/en/doc/vps/escritorio-remoto-windows/) exposed to the internet, it will receive login attempts from day one. Port **3389** (RDP) is among the most scanned in the world: botnets try usernames and passwords around the clock against any IP that answers. These are the measures that reduce the risk the most, ordered from most to least effective.

## 1. Restrict who can connect (the most effective measure)

Ideally the RDP port should **not be open to the whole internet**, only to the IPs you work from.

- **On a GINERNET VPS, from the Manager firewall**: it filters outside the machine, so unauthorized traffic never even reaches Windows. A new Windows VPS starts in protected mode: all inbound traffic is blocked except ping and RDP (TCP 3389), which is open to any source so you can log in the first time. To restrict it, open the VPS **Firewall** tab, edit that rule, change its **Source** to your IP in CIDR format (for example `203.0.113.10/32`) and click **Apply**. If you connect from several offices, create an **IP set** with all your IPs (under *IP MANAGEMENT › IP Sets*) and use it as the source.
- **In the Windows firewall**, as a second layer: open `wf.msc`, find the **Remote Desktop** inbound rules and, on the **Scope** tab, limit the remote IP addresses to yours.
- **If your IP changes** (home or mobile connections), use a VPN with a fixed IP, for example [WireGuard on a small Linux VPS](https://ginernet.com/en/doc/vps/crea-tu-servidor-vpn-con-wireguard/). You connect to the VPN and allow RDP only from that VPS's IP. If that is not feasible, the next measure is essential.

:::tip
Before restricting the source, check your current public IP (for example, by searching "what is my IP"). If you get it wrong, nothing serious happens: the Manager firewall is fixed from the panel even if you cannot reach the server.
:::

## 2. Block brute force automatically with RdpGuard

If you cannot limit RDP to a few IPs (users with dynamic IPs, remote work, people connecting from anywhere), we recommend installing [RdpGuard](https://rdpguard.com/). It is an intrusion prevention system for Windows, the equivalent of Fail2Ban on Linux: it watches failed logins and **automatically blocks the IP** that exceeds the number of attempts you configure, for as long as you choose.

- It runs as a Windows service, so it protects the server even when nobody is logged in.
- It blocks through the Windows Filtering Platform: it does not depend on the Windows firewall being enabled.
- **IP Cloud** blocks IPs that have already attacked other RdpGuard servers before their first attempt, and **Geo-IP** lets you accept connections only from the countries you choose: useful if your IP is dynamic but you always connect from the same country. Both services require up-to-date license maintenance (the first year is included).
- Besides RDP, it protects other services on the same server, such as MS SQL Server, MySQL, FTP, mail (SMTP, IMAP and POP3), IIS or OpenSSH.

It is commercial software, with a one-time license per server and a **30-day free trial** with every feature. Download it from its [official website](https://rdpguard.com/download.aspx); it runs on 64-bit Windows 10 and 11 and Windows Server.

:::warning
Right after installing it, add your trusted IPs to the whitelist (**Tools › Whitelist** menu) so a mistyped password does not block you. If it happens, log in through the Manager **VNC console** and unblock your IP from RdpGuard.
:::

## 3. A strong password and a limit on attempts

Most RDP break-ins start with a weak or reused password. Use a **long** password (16 characters or more), unique to that machine; a password manager helps. If several people connect, give each their own user, and disable accounts you do not use.

On a GINERNET Windows VPS you choose the administrator username when you create it (the Manager rejects predictable names such as `admin` or `administrator`) and the initial password is random, 16 characters long. If you change it, do not go below that length.

Windows can also **temporarily lock an account** after several failed attempts. Check the policy from an administrator terminal with `net accounts` (the *Lockout threshold*, *Lockout duration* and *Lockout observation window* lines). If the threshold is `Never`, apply Microsoft's recommendation: lock after 10 failed attempts within 10 minutes, for 10 minutes.

```
net accounts /lockoutthreshold:10 /lockoutwindow:10 /lockoutduration:10
```

:::info
While RDP is open to the whole internet, bots can keep your account locked with failed attempts. Restricting the source (step 1) prevents it, and so does RdpGuard if you set its threshold below the Windows one (for example, 5 attempts): it then blocks the attacking IP before your account gets locked.
:::

## 4. Keep NLA enabled

With **NLA** (Network Level Authentication), Windows requires authentication before creating the graphical session. This reduces exposure to automated attacks and to pre-authentication vulnerabilities such as BlueKeep. It is enabled by default on Windows 11 and Windows Server; check it under **Settings → System → Remote Desktop** (the option to require devices to use Network Level Authentication) or, on any version, with `sysdm.cpl` → **Remote** tab.

## 5. Keep Windows updated

The serious RDP flaws of recent years were already patched when mass attacks began: BlueKeep (CVE-2019-0708) was fixed in May 2019 and large-scale attacks arrived months later, against unpatched machines. Keep Windows Update on and, on a server, set the **active hours** so restarts happen at a low-usage time.

## 6. Change the RDP port (optional)

Moving away from 3389 will not stop an attacker targeting you, but it greatly reduces the noise from automated scans: fewer failed logins, fewer account lockouts and cleaner logs. It complements the measures above; it does not replace them.

On a GINERNET VPS the new port must be opened **in two firewalls**: the Manager's and Windows'. The example uses 3390; a less obvious port (between 10000 and 49151) gets even fewer scans. Follow this order:

**Step 1. Open the new port in the Manager firewall.** On the VPS **Firewall** tab, create an inbound rule accepting TCP on destination port `3390` (limited to your IP if you can) and click **Apply**. Do not delete the 3389 rule yet.

**Step 2. Open it in the Windows firewall too**, from an administrator terminal (PowerShell or CMD both work):

```
netsh advfirewall firewall add rule name=RDP-3390-TCP dir=in action=allow protocol=TCP localport=3390
netsh advfirewall firewall add rule name=RDP-3390-UDP dir=in action=allow protocol=UDP localport=3390
```

**Step 3. Change the listening port** in the registry:

```
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 3390 /f
```

**Step 4. Restart Windows** with `shutdown /r /t 0` (or from the Manager). Your RDP session will drop.

**Step 5. Connect specifying the port**: `IP:3390` in `mstsc` or Windows App.

**Step 6. Close the old port.** Once you have confirmed you can log in on the new one, delete the 3389 rule in the Manager firewall and click **Apply**.

:::warning
Keep this order: first open the new port in both firewalls, then change the registry. If Windows starts listening on a port that either firewall blocks, you will lose RDP access and will have to use the console (see the next section).
:::

:::tip
The Manager opens RDP over TCP only, and that is enough. If you also open **UDP** on the same port (the second Windows rule already allows it), the client can use UDP transport, which is usually smoother on lossy or high-latency connections.
:::

## If you get locked out

- The Manager **VNC console** (**Open console** button on the VPS page) shows the server screen without going through RDP. From there you can go back to port 3389 (the same `reg add` with `/d 3389`), review the Windows firewall or unblock your IP in RdpGuard, and restart.
- The **Manager firewall** rules are edited from the panel even if you cannot reach the server.
- If you have lost the password, you can **regenerate it from the Manager**; this requires the QEMU Guest Agent to keep running inside Windows.

## Final checklist

| Measure | What it protects against |
|---|---|
| IP-restricted access or VPN | Scans, brute force and exploits from unauthorized sources |
| RdpGuard | Brute force from changing IPs and lockouts of your account |
| Long, unique password | Guessed or leaked passwords |
| Account lockout after failed attempts | Sustained brute force against one account |
| NLA enabled | Pre-authentication attacks |
| Updated Windows | Known vulnerabilities |
| Changed port | Mass scan noise |

On a [GINERNET Windows VPS](https://ginernet.com/en/windows-vps/) you can apply this checklist from day one: RDP prepared during provisioning, an external firewall managed from the Manager with source IP rules, and a VNC console to recover access if something goes wrong. For general measures that apply to any server, see also [how to secure a server](https://ginernet.com/en/doc/vps/como-proteger-un-servidor/).