How to Secure Remote Desktop in Windows

Step by step

1. 1 min

   Enforce Network Level Authentication

   Open Settings, navigate to System, and select Remote Desktop. Click the arrow next to Remote Desktop to expand options and toggle on 'Require devices to use Network Level Authentication to connect'. This forces the client to authenticate before a full session is established, mitigating exposure to pre-authentication exploits.

   Note: NLA is mandatory for securing your remote session against unauthorized connection attempts.
2. 2 min

   Limit User Access Permissions

   Within the same Remote Desktop settings menu, click 'Remote users' to open the Remote Desktop Users window. Remove any unnecessary accounts and ensure only the specific, standard user account required for remote access is present. Avoid using the primary Administrator account for remote connections.

   Note: Applying the Principle of Least Privilege reduces the impact of a compromised account.
3. 3 min

   Change the Default RDP Port

   Press Win + R, type 'regedit', and navigate to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp. Locate 'PortNumber', double-click it, select 'Decimal', and change the value from 3389 to a non-standard port between 50000 and 60000. Restart the machine to apply the changes.

   Note: Changing the port hides your connection from basic automated internet scanners.
4. 2 min

   Update Windows Firewall Rules

   Open Windows Defender Firewall with Advanced Security. Select 'Inbound Rules', find 'Remote Desktop - User Mode (TCP-In)', and modify the port to match the new value set in the registry. Restrict the rule scope by setting the Remote IP address to specific known IP addresses instead of 'Any IP address'.

   Note: Never expose Remote Desktop directly to the public internet without IP filtering.
5. 1 min

   Review Account Lockout Policies

   Run 'secpol.msc' and navigate to Account Policies > Account Lockout Policy. Set 'Account lockout threshold' to 5 invalid logon attempts. This prevents brute-force attacks from successfully guessing your password over time.

   Note: Five attempts provide a balance between security and preventing legitimate lockouts.