Windows Server: connect with RDP and secure it

What you get

A Windows Server 2019, 2022 or 2025 VPS on Joy boots with Remote Desktop enabled, Network Level Authentication on, the static IP configured and the Administrator password shown on the server page. The licence is included through the Windows add-on on your plan.

1. Connect

Windows: press Win+R, run mstsc, enter YOUR_IP, user Administrator, the password from the console.
macOS: install "Windows App" (formerly Microsoft Remote Desktop) from the App Store and add a PC with the IP.
Linux: xfreerdp /v:YOUR_IP /u:Administrator /p:'PASSWORD' /dynamic-resolution /cert:ignore or Remmina.
iOS / Android: the Microsoft Remote Desktop app.

The first connection shows a certificate warning because the server uses a self-signed certificate; accept it. Copy and paste works through the clipboard; drives can be shared from the client's Local Resources tab.

2. Change the password

Inside the session press Ctrl+Alt+End → Change a password. Use at least 16 characters. The console's "Reset password" button generates a new one through the guest agent if you ever lose it.

3. Change the RDP port

Bots scan port 3389 constantly. Moving it removes most noise:

Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name PortNumber -Value 3390
New-NetFirewallRule -DisplayName 'RDP 3390' -Direction Inbound -Protocol TCP -LocalPort 3390 -Action Allow
Restart-Service TermService -Force

Reconnect with YOUR_IP:3390. Keep the console open until the new port works.

4. Restrict who can connect

If you always connect from the same place, allow only that address in the firewall rule (Scope → Remote IP address). Otherwise consider a VPN or the RDP Gateway role for teams.

5. Lockout policy and NLA

Open secpol.msc → Account Policies → Account Lockout Policy: threshold 5 attempts, duration 15 minutes. Confirm NLA is on: System → Remote Desktop → Advanced settings → Require devices to use Network Level Authentication. Create a separate administrator account for daily use and rename the built-in Administrator.

6. Windows Update

Run Settings → Windows Update and reboot. Set active hours so automatic reboots do not hit your users. Take a snapshot from the server page before large updates — rollback takes seconds.

7. Windows Defender Firewall

Only open what you need. Common inbound rules: RDP on your chosen port, 80/443 for web, your application ports. Leave file sharing (445) closed unless you are on a private VLAN. See Firewall basics.

8. Performance tips

Windows needs 2 GB RAM minimum; 4 GB for anything beyond a single application.
Disable visual effects (System → Advanced → Performance) for snappier sessions over long distances.
The virtio drivers are preinstalled in Joy templates; do not remove the QEMU guest agent — live stats and password resets depend on it.

Troubleshooting

Cannot connect after changing the port — use the noVNC console from the server page and check the firewall rule. "An internal error has occurred" — usually a certificate or NLA issue; restart TermService. Slow or laggy — lower the display resolution and colour depth in the client, or choose the region nearest you next time.