How to Enable Remote Desktop Securely on Windows Server

Applies to: Windows Server 2019, 2022 and 2025.

Administrative Remote Desktop should be enabled with Network Level Authentication and a restricted path such as VPN, RD Gateway or source allow-listing. Public exposure of TCP 3389 invites continuous scanning.

Work from console access or a tested recovery path. Changes to remote access, licensing or domain membership can lock out administrators if prerequisites are wrong. Managed Windows VPS options are available at networkmanager.info.

Prerequisites

• Maintain console access.
• Create individual named accounts.
• Define the approved source network or gateway.
• Distinguish two administrative sessions from licensed business RDS.

Step-by-step procedure

Step 1: Read current state

Inspect the terminal-server setting and firewall rules.

Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections
Get-NetFirewallRule -DisplayGroup 'Remote Desktop'

Step 2: Enable connections

Change the deny flag to zero.

Set-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections -Value 0

Step 3: Require NLA

Enable user authentication before session creation.

Set-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name UserAuthentication -Value 1

Step 4: Enable built-in firewall rules

Enable the rule group, then restrict its scope through the network design.

Enable-NetFirewallRule -DisplayGroup 'Remote Desktop'

Step 5: Test through the approved route

Connect from a representative client and review the security log.

Verification

Confirm the listener exists and only approved firewall profiles and sources are permitted.

Get-NetTCPConnection -LocalPort 3389 -State Listen
Get-NetFirewallRule -DisplayGroup 'Remote Desktop' | Select DisplayName,Enabled,Profile

Rollback

From console, disable the firewall group and set fDenyTSConnections to 1. Never disable the only working session without console recovery.

Version and operational notes

RDS Session Host used by employees requires RDS roles and appropriate CALs; administrative RDP is not a substitute.

Official references

• Microsoft Windows Server documentation
• Microsoft Server Core documentation

For managed deployment and support, visit https://networkmanager.info/.