How to connect to a Windows VPS with RDP

Step 1: Find the IP address and Administrator password

Open the client area and go to Servicesyour VPS. The IPv4 address and the Administrator password appear there as soon as the server is ready, usually within 15 minutes of payment, and in your welcome email. Copy the password rather than typing it: it's long and random on purpose.

Step 2: Connect from your computer or phone

Pick your device. Every app shows a certificate warning on the first connection, because a new server uses a self-signed certificate for RDP. That's expected: check the address is your VPS and accept it.

Step 3: Change the Administrator password

The first password has been in an email, so replace it now. On Windows, press Ctrl + Alt + End inside the session (the remote version of Ctrl + Alt + Del) and choose Change a password. From any device, you can instead open PowerShell on the server and run:

net user Administrator *        # type the new password twice; nothing shows as you type

Use at least 16 characters and keep it in a password manager. Every RDP scanner tries Administrator first, so it's also worth creating your own administrator account and signing in with that:

net user yourname * /add
net localgroup Administrators yourname /add

Step 4: Lock down Remote Desktop

1. Check Network Level Authentication is on

   NLA makes every visitor sign in before Windows starts a session, which blocks a whole class of attacks and stops scanners using up memory. Run SystemPropertiesRemote and confirm Allow connections only from computers running Remote Desktop with Network Level Authentication is ticked. Or check in PowerShell, where 1 means on:

   $rdp = Get-CimInstance -Namespace root\cimv2\terminalservices `
     -ClassName Win32_TSGeneralSetting -Filter "TerminalName='RDP-tcp'"
   $rdp.UserAuthenticationRequired

2. Allow RDP only from your IP addresses

   This one change stops almost every brute-force attempt. In PowerShell as administrator, limit the built-in Remote Desktop rules to the addresses you connect from (your office, your home):

   Set-NetFirewallRule -DisplayGroup "Remote Desktop" `
     -RemoteAddress 198.51.100.7, 203.0.113.0/24
   Get-NetFirewallRule -DisplayGroup "Remote Desktop" | Get-NetFirewallAddressFilter

   In the window instead: run wf.msc, open Inbound Rules, and on each Remote Desktop - User Mode rule set PropertiesScopeRemote IP address to These IP addresses.

   Home broadband IPs change. Most Indian ISPs give home connections an address that changes when the router restarts. If you're locked out, open Console in the client area and add your new IP, or allow your ISP's range instead of a single address.

3. Lock accounts after repeated wrong passwords

   This locks an account for 15 minutes after 10 failed attempts, which makes password guessing useless:

   net accounts /lockoutthreshold:10 /lockoutduration:15 /lockoutwindow:15

4. Keep Windows Update on

   Open SettingsWindows Update, install everything offered and restart. Most RDP attacks use flaws that were patched long ago.

Step 5: Change the RDP port safely (optional)

Moving RDP off 3389 doesn't make it secure, but it cuts the constant noise from scanners in your logs. The order matters: open the new port before you move to it, so you can't lock yourself out. Pick a number between 1024 and 49151 that nothing else uses, then run this in PowerShell as administrator:

$port = 40189
# 1. Allow the new port first (add -RemoteAddress as in Step 4)
New-NetFirewallRule -DisplayName "RDP $port TCP" -Direction Inbound `
  -Protocol TCP -LocalPort $port -Action Allow
New-NetFirewallRule -DisplayName "RDP $port UDP" -Direction Inbound `
  -Protocol UDP -LocalPort $port -Action Allow

# 2. Listen on the new port, then restart (you'll be disconnected)
$key = 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp'
Set-ItemProperty -Path $key -Name PortNumber -Value $port
Restart-Service TermService -Force

Reconnect using 203.0.113.42:40189. Only once that works, close the old port:

Disable-NetFirewallRule -DisplayGroup "Remote Desktop"

If the new port doesn't answer, open Console in the client area, set PortNumber back to 3389 and restart the service again.

Copy files, disconnect and add users

• Copy and paste of text and files works by default. For whole folders, share a drive: in mstsc, open Show OptionsLocal ResourcesMore and tick it; it appears under This PC on the server. In the Windows App, edit the PC and turn on folder redirection.
• Closing the window disconnects but leaves your programs running, which is handy for long jobs. Sign out from the Start menu to end the session and free its memory.
• Two people at once is the limit for administration. Staff who work on the server every day need Remote Desktop Services licences, which our sales team can quote; plan on VC-4 or larger for several active users.

Windows VPS RDP troubleshooting

quser                 # lists sessions and their IDs
logoff 2              # ends session 2