# How to Secure Remote Desktop (RDP) in Windows 11

URL: https://www.mytechnician.tech/tips/secure-remote-desktop-rdp-windows-11/
Published: 2026-08-07 | Author: Ankit Kumar
Tags: Windows 11, Security, Network, Setup, Privacy
Summary: RDP exposed to the internet is a top ransomware entry point. Lock it down with Network Level Authentication, lockout policy, and a VPN instead of port forwarding.
Recommended app: Network Traffic Monitor & Analyzer — https://www.mytechnician.tech/apps/network-monitor/ (Microsoft Store: https://apps.microsoft.com/detail/9NGCWN2BKVSC?hl=en-us&cid=mytechnician-web). Optional; every step below uses built-in Windows tools.

## The Problem
Remote Desktop is genuinely useful — reach your desktop from a laptop, help a family member, get to a work machine from home. It is also, in its default internet-facing configuration, the most reliably exploited service on a home or small-business network.

The reason is simple. Port 3389 forwarded through a router gives the entire internet a Windows login prompt. Automated tools find it within hours and try username and password combinations continuously, drawing on breach data for the passwords. A large share of small-business ransomware incidents begin exactly there: exposed RDP, weak password, no lockout.

None of that means you should not use RDP. It means you should never expose it directly. This guide covers hardening the service and, more importantly, the network arrangement that removes the exposure entirely.

> **Just want it working at all?** Start with [set up Remote Desktop in Windows 11](https://www.mytechnician.tech/tips/setup-remote-desktop-windows-11/), then come back here before you make it reachable from outside your home.

## The Fix: Step-by-Step

### Step 1: Decide Whether You Need It Enabled at All
If you are not actively using Remote Desktop, turn it off. **Settings** → **System** → **Remote Desktop** → **Off**.

A disabled service cannot be attacked, and Windows 11 Home does not include the RDP server at all — only the client — so many people have it off already without realising.

### Step 2: Never Port Forward 3389 — Use a VPN Instead
This is the single most important change on the page, and it replaces every other mitigation.

**Option A — mesh VPN (easiest).** Install Tailscale or ZeroTier on both the PC and the device you connect from. They create an encrypted link between your own machines with **no inbound port open at all**. Nothing is exposed to scanners. It works behind CGNAT, and setup takes about ten minutes.

**Option B — router VPN.** Many routers include a WireGuard or OpenVPN server. Enable it, connect to your home network from outside, then use RDP over that tunnel to the internal IP address.

**Option C — RD Gateway.** In a business environment, an RD Gateway terminates connections over HTTPS with proper authentication in front of RDP.

If you currently have a forwarding rule for 3389, delete it now: [port forwarding and UPnP security risks](https://www.mytechnician.tech/tips/port-forwarding-upnp-security-risks/).

### Step 3: Require Network Level Authentication
NLA makes the client authenticate *before* a session is established, so an unauthenticated attacker cannot reach the Windows logon subsystem at all. It also blunts several historic RDP vulnerabilities.

1. **Settings** → **System** → **Remote Desktop** → expand the settings.
2. Ensure **Require devices to use Network Level Authentication to connect** is **On**.

This is on by default in Windows 11 — verify rather than assume, particularly on a machine upgraded from an older Windows version.

### Step 4: Restrict Who Can Connect
By default, every administrator on the PC can sign in over RDP. Narrow that.

1. `Win + R` → `SystemPropertiesRemote`.
2. **Select Users** → add only the specific account that needs remote access.
3. Remove any account that does not.

Better still, create a dedicated standard user for remote sessions rather than using an administrator account — see [configure UAC and a standard user account](https://www.mytechnician.tech/tips/configure-uac-and-standard-user-account-windows-11/).

Accounts with **blank passwords cannot use RDP** by default. Do not change that policy.

### Step 5: Set an Account Lockout Policy
Without a lockout, an attacker can guess passwords indefinitely. Windows 11 sets a default lockout on recent builds, but verify it.

On Pro: `Win + R` → `secpol.msc` → **Account Policies** → **Account Lockout Policy**:

* **Account lockout threshold:** 10 invalid attempts
* **Account lockout duration:** 15 minutes
* **Reset account lockout counter after:** 15 minutes

On Home, from **Terminal (Admin)**:

```
net accounts /lockoutthreshold:10 /lockoutduration:15 /lockoutwindow:15
```

Be aware this makes your own account lockable — which is the point, but keep a second administrator account available.

### Step 6: Use a Strong, Unique Password and Add a Second Factor
RDP authenticates against your Windows account, so that password is the whole defence.

* Long and unique, from your password manager: [use a password manager safely](https://www.mytechnician.tech/tips/use-a-password-manager-safely/).
* Never reused from any other service — credential-stuffing tools try breach pairs against RDP directly.
* Check exposure: [check if your email was in a data breach](https://www.mytechnician.tech/tips/check-if-your-email-was-in-a-data-breach/).

Windows does not offer built-in MFA for RDP on Home or Pro. If you need it, the practical route is putting RDP behind a VPN that has its own MFA — another argument for Step 2.

### Step 7: Change the Listening Port (Minor, Not a Substitute)
If RDP is only reachable over your VPN, this is unnecessary. If it is reachable on a local network with untrusted devices, moving off 3389 removes most automated noise.

`Win + R` → `regedit` →
`HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp` → set **PortNumber** (decimal) to something in the 49152–65535 range, then add a matching firewall rule and restart.

Treat this as noise reduction only. It is not security, and it does not make forwarding safe.

### Step 8: Scope the Firewall Rule
Restrict which addresses can even reach the service.

1. `Win + R` → `wf.msc` → **Inbound Rules**.
2. Find **Remote Desktop - User Mode (TCP-In)**.
3. **Properties** → **Scope** → under **Remote IP address**, choose **These IP addresses** and add your local subnet (for example `192.168.1.0/24`) and your VPN subnet.

Now even if something exposes the port, only those ranges are accepted. Related: [Windows Firewall blocking apps](https://www.mytechnician.tech/tips/fix-windows-firewall-blocking-apps-windows-11/).

### Step 9: Watch the Logs
Failed sign-ins are logged whether or not anyone tells you.

`Win + R` → `eventvwr.msc` → **Windows Logs** → **Security**. Filter for event ID **4625** (failed logon) and **4624** with logon type **10** (successful remote interactive logon).

A steady stream of 4625 events from external addresses means the service is exposed and being attacked — go back to Step 2. A successful type-10 logon you cannot account for is an incident: see [what to do after a remote access scam](https://www.mytechnician.tech/tips/what-to-do-after-remote-access-scam-anydesk-teamviewer/) for the response checklist.

More on reading these: [how to read Event Viewer](https://www.mytechnician.tech/tips/how-to-read-event-viewer-find-crash-cause/).

### Step 10: Keep Windows Patched
Several of the most serious RDP vulnerabilities of recent years were pre-authentication and wormable. Patching is not optional for any machine running the service.

Check **Settings** → **Windows Update** and make sure updates are installing. If they are failing, fix that first: [Windows 11 update errors](https://www.mytechnician.tech/tips/fix-windows-11-update-errors/).

## Exposure Options, Ranked

| Setup | Exposure | Verdict |
|---|---|---|
| RDP over mesh VPN (Tailscale/ZeroTier) | None | Best for home |
| RDP over router VPN (WireGuard) | VPN port only | Very good |
| RDP behind RD Gateway | HTTPS with auth | Business standard |
| RDP on a non-standard forwarded port | Full, slightly quieter | Not acceptable |
| RDP forwarded on 3389 | Full | Do not do this |

## What Not to Do
* **Do not port forward RDP**, on any port, with any password. There is a safer option for every use case.
* **Do not disable Network Level Authentication** to fix a connection problem. Fix the client instead.
* **Do not use the same password** on the Windows account as on any online service.
* **Do not leave RDP enabled** on a laptop that travels. It will end up on hotel and café networks: [stay safe on public Wi-Fi](https://www.mytechnician.tech/tips/stay-safe-on-public-wifi/).

## FAQ

### Is RDP safe to use at all?
Yes, on a local network or over a VPN. RDP itself is encrypted and, with NLA, requires authentication before a session starts. The danger comes almost entirely from exposing it directly to the internet, where it is attacked continuously by automated tools.

### Does changing the RDP port make it secure?
No. It reduces automated background noise, but any full port scan finds the service in seconds. Treat it as tidying, never as protection — the real fix is not being reachable from the internet.

### Can I use Remote Desktop on Windows 11 Home?
You can connect *from* Home to another PC, but Home cannot host RDP sessions. To be reached remotely from a Home machine you need Windows 11 Pro, or a third-party tool such as Chrome Remote Desktop — with the same rule about not exposing it.

### What is Network Level Authentication actually doing?
It requires the client to prove credentials before the remote session and the full Windows logon interface are created. That means an unauthenticated attacker never reaches the code paths that several past RDP vulnerabilities targeted, and it uses fewer resources on the host during brute-force attempts.

### Is Tailscale or a router VPN better?
Tailscale is easier and works behind CGNAT, which many home connections now use. A router VPN gives you access to the whole home network with no extra service running on each device. Both remove internet exposure of RDP, which is the goal — pick whichever you will actually keep configured.

### How do I tell if my RDP has already been attacked?
Filter the Security log for event ID 4625. Occasional failures are normal typos; hundreds from foreign addresses mean the port is exposed. A successful remote logon (4624, logon type 10) at a time you were not connecting is a compromise, not an anomaly.

## Still Not Working?
If connections fail after hardening, work back through the changes: firewall scope too narrow, the account removed from the allowed users list, or the port change made without a matching firewall rule. If you have locked yourself out remotely, you will need local access to the machine — which is a good argument for testing each change while you are still sitting in front of it.

Related: [set up Remote Desktop in Windows 11](https://www.mytechnician.tech/tips/setup-remote-desktop-windows-11/), [port forwarding and UPnP security risks](https://www.mytechnician.tech/tips/port-forwarding-upnp-security-risks/), [set up a VPN on Windows 11](https://www.mytechnician.tech/tips/setup-vpn-windows-11/).

---
Source: https://www.mytechnician.tech/tips/secure-remote-desktop-rdp-windows-11/ — My Technician, free Windows 10/11 troubleshooting guides.
Related tool: Network Traffic Monitor & Analyzer (Network Traffic Monitor & Analyzer shows real-time bandwidth usage, active connections, and per-app network traffic on Windows 10 and 11.) — https://www.mytechnician.tech/apps/network-monitor/
More guides: https://www.mytechnician.tech/llms.txt