How to Secure Remote Desktop (RDP) in Windows 11

The Problem

Remote Desktop is genuinely useful — reach your desktop from a laptop, help a family member, get to a work machine from home. It is also, in its default internet-facing configuration, the most reliably exploited service on a home or small-business network.

The reason is simple. Port 3389 forwarded through a router gives the entire internet a Windows login prompt. Automated tools find it within hours and try username and password combinations continuously, drawing on breach data for the passwords. A large share of small-business ransomware incidents begin exactly there: exposed RDP, weak password, no lockout.

None of that means you should not use RDP. It means you should never expose it directly. This guide covers hardening the service and, more importantly, the network arrangement that removes the exposure entirely.

Just want it working at all? Start with set up Remote Desktop in Windows 11, then come back here before you make it reachable from outside your home.

The Fix: Step-by-Step

Step 1: Decide Whether You Need It Enabled at All

If you are not actively using Remote Desktop, turn it off. Settings → System → Remote Desktop → Off.

A disabled service cannot be attacked, and Windows 11 Home does not include the RDP server at all — only the client — so many people have it off already without realising.

Step 2: Never Port Forward 3389 — Use a VPN Instead

This is the single most important change on the page, and it replaces every other mitigation.

Option A — mesh VPN (easiest). Install Tailscale or ZeroTier on both the PC and the device you connect from. They create an encrypted link between your own machines with no inbound port open at all. Nothing is exposed to scanners. It works behind CGNAT, and setup takes about ten minutes.

Option B — router VPN. Many routers include a WireGuard or OpenVPN server. Enable it, connect to your home network from outside, then use RDP over that tunnel to the internal IP address.

Option C — RD Gateway. In a business environment, an RD Gateway terminates connections over HTTPS with proper authentication in front of RDP.

If you currently have a forwarding rule for 3389, delete it now: port forwarding and UPnP security risks.

Step 3: Require Network Level Authentication

NLA makes the client authenticate before a session is established, so an unauthenticated attacker cannot reach the Windows logon subsystem at all. It also blunts several historic RDP vulnerabilities.

Settings → System → Remote Desktop → expand the settings.
Ensure Require devices to use Network Level Authentication to connect is On.

This is on by default in Windows 11 — verify rather than assume, particularly on a machine upgraded from an older Windows version.

Step 4: Restrict Who Can Connect

By default, every administrator on the PC can sign in over RDP. Narrow that.

Win + R → SystemPropertiesRemote.
Select Users → add only the specific account that needs remote access.
Remove any account that does not.

Better still, create a dedicated standard user for remote sessions rather than using an administrator account — see configure UAC and a standard user account.

Accounts with blank passwords cannot use RDP by default. Do not change that policy.

Step 5: Set an Account Lockout Policy

Without a lockout, an attacker can guess passwords indefinitely. Windows 11 sets a default lockout on recent builds, but verify it.

On Pro: Win + R → secpol.msc → Account Policies → Account Lockout Policy:

Account lockout threshold: 10 invalid attempts
Account lockout duration: 15 minutes
Reset account lockout counter after: 15 minutes

On Home, from Terminal (Admin):

net accounts /lockoutthreshold:10 /lockoutduration:15 /lockoutwindow:15

Be aware this makes your own account lockable — which is the point, but keep a second administrator account available.

Step 6: Use a Strong, Unique Password and Add a Second Factor

RDP authenticates against your Windows account, so that password is the whole defence.

Long and unique, from your password manager: use a password manager safely.
Never reused from any other service — credential-stuffing tools try breach pairs against RDP directly.
Check exposure: check if your email was in a data breach.

Windows does not offer built-in MFA for RDP on Home or Pro. If you need it, the practical route is putting RDP behind a VPN that has its own MFA — another argument for Step 2.

Step 7: Change the Listening Port (Minor, Not a Substitute)

If RDP is only reachable over your VPN, this is unnecessary. If it is reachable on a local network with untrusted devices, moving off 3389 removes most automated noise.

Win + R → regedit → HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp → set PortNumber (decimal) to something in the 49152–65535 range, then add a matching firewall rule and restart.

Treat this as noise reduction only. It is not security, and it does not make forwarding safe.

Step 8: Scope the Firewall Rule

Restrict which addresses can even reach the service.

Win + R → wf.msc → Inbound Rules.
Find Remote Desktop - User Mode (TCP-In).
Properties → Scope → under Remote IP address, choose These IP addresses and add your local subnet (for example 192.168.1.0/24) and your VPN subnet.

Now even if something exposes the port, only those ranges are accepted. Related: Windows Firewall blocking apps.

Step 9: Watch the Logs

Failed sign-ins are logged whether or not anyone tells you.

Win + R → eventvwr.msc → Windows Logs → Security. Filter for event ID 4625 (failed logon) and 4624 with logon type 10 (successful remote interactive logon).

A steady stream of 4625 events from external addresses means the service is exposed and being attacked — go back to Step 2. A successful type-10 logon you cannot account for is an incident: see what to do after a remote access scam for the response checklist.

More on reading these: how to read Event Viewer.

Step 10: Keep Windows Patched

Several of the most serious RDP vulnerabilities of recent years were pre-authentication and wormable. Patching is not optional for any machine running the service.

Check Settings → Windows Update and make sure updates are installing. If they are failing, fix that first: Windows 11 update errors.

Exposure Options, Ranked

| Setup | Exposure | Verdict | |---|---|---| | RDP over mesh VPN (Tailscale/ZeroTier) | None | Best for home | | RDP over router VPN (WireGuard) | VPN port only | Very good | | RDP behind RD Gateway | HTTPS with auth | Business standard | | RDP on a non-standard forwarded port | Full, slightly quieter | Not acceptable | | RDP forwarded on 3389 | Full | Do not do this |

What Not to Do

Do not port forward RDP, on any port, with any password. There is a safer option for every use case.
Do not disable Network Level Authentication to fix a connection problem. Fix the client instead.
Do not use the same password on the Windows account as on any online service.
Do not leave RDP enabled on a laptop that travels. It will end up on hotel and café networks: stay safe on public Wi-Fi.

FAQ

Is RDP safe to use at all?

Yes, on a local network or over a VPN. RDP itself is encrypted and, with NLA, requires authentication before a session starts. The danger comes almost entirely from exposing it directly to the internet, where it is attacked continuously by automated tools.

Does changing the RDP port make it secure?

No. It reduces automated background noise, but any full port scan finds the service in seconds. Treat it as tidying, never as protection — the real fix is not being reachable from the internet.

Can I use Remote Desktop on Windows 11 Home?

You can connect from Home to another PC, but Home cannot host RDP sessions. To be reached remotely from a Home machine you need Windows 11 Pro, or a third-party tool such as Chrome Remote Desktop — with the same rule about not exposing it.

What is Network Level Authentication actually doing?

It requires the client to prove credentials before the remote session and the full Windows logon interface are created. That means an unauthenticated attacker never reaches the code paths that several past RDP vulnerabilities targeted, and it uses fewer resources on the host during brute-force attempts.

Is Tailscale or a router VPN better?

Tailscale is easier and works behind CGNAT, which many home connections now use. A router VPN gives you access to the whole home network with no extra service running on each device. Both remove internet exposure of RDP, which is the goal — pick whichever you will actually keep configured.

How do I tell if my RDP has already been attacked?

Filter the Security log for event ID 4625. Occasional failures are normal typos; hundreds from foreign addresses mean the port is exposed. A successful remote logon (4624, logon type 10) at a time you were not connecting is a compromise, not an anomaly.

Still Not Working?

If connections fail after hardening, work back through the changes: firewall scope too narrow, the account removed from the allowed users list, or the port change made without a matching firewall rule. If you have locked yourself out remotely, you will need local access to the machine — which is a good argument for testing each change while you are still sitting in front of it.