Skip to main content
A Windows server with a public IP address gets constant automated password-guessing on its Remote Desktop Protocol (RDP) port. You have full Administrator access, so securing the server is up to you. These steps take a few minutes; do them right after your first sign-in.
A mistake in these steps can lock you out of Remote Desktop. Keep the server’s page in the Billing Portal open: the Console button gives you a direct screen and keyboard to the server, so you can undo a firewall or port change.
1

Use a strong password and keep Windows updated

Use a long, unique password for every account that can sign in over RDP. Install Windows updates regularly, and keep Network Level Authentication turned on (it is on by default).
2

Change the default RDP port

RDP uses port 3389 by default, and bots scan it constantly. Moving RDP to another port cuts down most automated attempts.
  1. Open PowerShell as Administrator.
  2. Allow the new port through Windows Firewall first, replacing 49152 with any free port between 1024 and 65535:
  1. Change the port RDP listens on:
  1. Restart the server from the Billing Portal.
  2. Connect to IP:PORT, for example 203.0.113.10:49152. The .rdp file in the Billing Portal still uses port 3389, so edit it or type the address yourself.
3

Create a new admin user and disable 'Administrator'

Bots usually try the username Administrator. Signing in with a different name stops those attempts.
  1. Press Windows key + R, type compmgmt.msc and press Enter to open Computer Management, then go to Local Users and Groups > Users.
  2. Right-click in the empty space and select New User. Give it a unique name and a strong password.
  3. Right-click your new user, select Properties > Member Of, and add it to the Administrators and Remote Desktop Users groups.
  4. Sign out, sign in with the new user, and check that it works. Then right-click the built-in Administrator account and disable it.
Reset password in the Billing Portal sets the password of the built-in Administrator account. If you disable or rename it, a portal password reset won’t get you back in. Always keep a working account in the Administrators group whose password you know; you can still sign in with it through the Console button.
4

Turn on account lockout

Windows can lock an account after repeated wrong passwords.
  1. Press Windows key + R, type secpol.msc and press Enter to open Local Security Policy.
  2. Go to Account Policies > Account Lockout Policy.
  3. Set Account lockout threshold to 5 invalid logon attempts, and accept the suggested lockout duration.
A locked account also locks you out until the duration passes, so keep a second admin account.
5

Allow RDP only from your IP address (optional)

If you connect from a fixed IP address, limit the RDP firewall rule to it:
If you kept port 3389, limit the built-in Remote Desktop rules instead:
If your home IP address changes, you will need the Console to update the rule.

Connect to your Windows RDP

DDoS protection

Reset server password

Run MT4 / MT5 for Forex Trading on a VPS

First steps on your Windows RDP

Password, updates, license, users and time zone.
Last modified on October 11, 2026