How to Harden RDP Access on Windows Server (2026)

RDP exposed directly to the internet is one of the most common initial access vectors in ransomware incidents. Mass credential-stuffing and brute-force scans against port 3389 are constant and automated. None of the fixes below are exotic; they’re standard practice that’s genuinely effective when combined.

• Never expose RDP directly to the internet. Put it behind a VPN or a dedicated jump host instead
• Enable Network Level Authentication (NLA). It’s on by default in recent Windows Server versions, but verify it
• Enforce MFA for RDP sessions using Azure MFA NPS extension or a third-party solution
• Change the default port only as a minor speed bump, never as your primary control
• Enable account lockout policies to blunt brute-force attempts

Take RDP off the internet entirely

This is the single most impactful change you can make. Put a VPN in front of RDP access, or route it through Azure Bastion / a dedicated jump host with its own MFA and logging, so port 3389 is never reachable from a random IP scanning the internet. Every other hardening step here is secondary to this one.

Confirm Network Level Authentication is enabled

NLA requires authentication before a full RDP session is established, which blocks a large class of pre-auth exploits:

Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -name "UserAuthentication" -Value 1

Add MFA to RDP logons

The Azure MFA extension for Network Policy Server (NPS) lets you require MFA at the RD Gateway or NPS level for RDP logons even for on-premises-only accounts synced from Entra ID. This single control stops the vast majority of credential-based RDP compromises even when a password has genuinely been stolen.

Lock out accounts after failed attempts

Configure an account lockout policy (typically 5-10 failed attempts within 15 minutes triggers a lockout) via Group Policy so brute-force scanning is self-defeating rather than an infinite guessing game. Combine this with monitoring for repeated 4625 logon failure events in the Security log, which will flag an active brute-force attempt long before it succeeds.

Don’t rely on changing the port alone

Moving RDP off 3389 reduces noise from the laziest automated scanners but does nothing against a targeted attacker or a slightly more thorough port scan. Treat it as a minor bonus on top of the controls above, never as a substitute for them.

For official guidance, see Microsoft’s Windows Server documentation.