Hardening Remote Desktop (RDP) on Windows

Remote Desktop is how most Windows servers are administered, and it is also one of the most common initial access and lateral movement channels in ransomware incidents. Exposed RDP gets brute-forced; internal RDP gets used with stolen credentials to hop from server to server. Most of the defence is not exotic: authenticate before a session exists, encrypt with a trusted certificate, limit who can connect from where, and log it.

This guide is part of the legacy protocols area. Protecting the administrator's credentials on the target server (Restricted Admin and Remote Credential Guard) is a separate topic covered in RDP without exposing credentials.

The settings in one table

All the Group Policy settings below are under Computer Configuration > Policies > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host, followed by the subfolder shown.

The matching registry values for the RDP listener live under HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp: UserAuthentication = 1 (NLA), SecurityLayer = 2 (TLS), MinEncryptionLevel = 3 (High). Policy values are written under HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services and take precedence.

Step 1: keep RDP off the internet

No setting in this guide makes RDP safe to expose directly. For remote access use one of:

• Remote Desktop Gateway with MFA (for example through the NPS extension for Microsoft Entra multifactor authentication), exposing only HTTPS.
• A VPN with MFA, with RDP reachable only from the VPN address pool.
• A cloud bastion service in front of cloud-hosted VMs.

Check your external exposure regularly from the outside, and review NAT rules on firewalls for port 3389 and anything forwarded to it. Changing the listening port (PortNumber under the RDP-Tcp key) is not a control.

Step 2: require Network Level Authentication

With NLA, the client authenticates with CredSSP before the server creates a session or shows a logon screen. That removes pre-authentication attack surface (BlueKeep-class vulnerabilities were mitigated by NLA) and stops anonymous users from consuming session resources.

NLA is the default on current Windows versions, but it is frequently switched off to "fix" a connection problem and never switched back. Enforce it by policy, then fix the underlying cause: typically an old client, a non-domain jump host, or a user who must change an expired password (NLA cannot prompt for a password change; users need another way to do that).

Also set Encryption Oracle Remediation to Force Updated Clients under Computer Configuration > Policies > Administrative Templates > System > Credentials Delegation, so neither side accepts unpatched CredSSP peers.

Step 3: use TLS with a trusted certificate

With the security layer set to SSL (TLS), every connection is encrypted with TLS and the server proves its identity with a certificate. By default that certificate is self-signed, so users learn to click through the warning, which is exactly what an attacker-in-the-middle relies on.

Issue RDP certificates from your internal PKI:

1. Duplicate the Computer template in AD CS, name it (for example RDP-Server), and make sure the application policies include Server Authentication (or the dedicated Remote Desktop Authentication OID 1.3.6.1.4.1.311.54.1.2). Grant autoenroll to the relevant computer groups.
2. Set Server authentication certificate template to that template name. Hosts enroll automatically and bind the certificate to the listener.
3. On clients, leave Configure server authentication for client (under Remote Desktop Connection Client) at Warn me or set it to Do not connect for admin workstations, so a certificate mismatch is not silently accepted.

Combined with TLS and Schannel hardening, this gives RDP a modern, authenticated channel.

Step 4: restrict who can connect, and from where

Users. The user right Allow log on through Remote Desktop Services (Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > User Rights Assignment) defaults to Administrators and Remote Desktop Users. Set it explicitly per server tier to a small admin group. Add Deny log on through Remote Desktop Services for local accounts (Local account and member of Administrators group, SID S-1-5-114) and, on lower tiers, for Tier 0 accounts, as described in admin tiering. Keep the local Remote Desktop Users group empty on servers unless it is managed centrally.

Workstations. Most user workstations do not need to accept RDP at all. Leave Allow users to connect remotely disabled on them; helpdesk can use a remote assistance tool instead.

Networks. Scope the inbound firewall rules to your admin network or privileged access workstations:

Set-NetFirewallRule -DisplayGroup "Remote Desktop" `
  -RemoteAddress 10.10.50.0/24 -Profile Domain

Do the same centrally through the firewall policy described in the Windows Firewall guide, which also blocks workstation-to-workstation RDP.

Brute force. Windows 11 22H2 and later ship with a default account lockout policy (10 failed attempts within 10 minutes) for local accounts. For domain accounts, your domain lockout policy applies. Lockout is a backstop, not a defence for exposed RDP.

Step 5: log RDP activity

Enable Audit Logon and Audit Other Logon/Logoff Events (success and failure) in advanced audit policy; the audit policy baseline covers both. Alert on RDP logons by privileged accounts outside PAWs, on RDP from workstations to workstations, and on bursts of 4625 events.

What breaks

• Password change at logon under NLA: users with expired passwords cannot connect until they reset elsewhere. Give them a self-service reset or change via Ctrl+Alt+End on a working session.
• Clipboard and drive redirection removal frustrates admins moving files. Provide a proper file transfer path.
• Old thin clients that do not support NLA or TLS 1.2.
• Session time limits end long-running interactive jobs. Run those as scheduled tasks or services, not in a disconnected session.

Verify it

Get-CimInstance -Namespace root\cimv2\TerminalServices -ClassName Win32_TSGeneralSetting `
  -Filter "TerminalName='RDP-Tcp'" |
  Select-Object UserAuthenticationRequired, SecurityLayer, MinEncryptionLevel, SSLCertificateSHA1Hash
Get-NetFirewallRule -DisplayGroup "Remote Desktop" | Get-NetFirewallAddressFilter

Expect UserAuthenticationRequired = 1, SecurityLayer = 2, MinEncryptionLevel = 3, and a certificate thumbprint that matches a PKI-issued certificate in the computer's personal store, not a self-signed one. Connect from a PAW and confirm there is no certificate warning; connect from a non-admin subnet and confirm it times out.

Checklist

• No RDP exposed to the internet; remote access through RD Gateway or VPN with MFA
• NLA required by policy; Encryption Oracle Remediation set to Force Updated Clients
• Security layer TLS, encryption level High, PKI certificates via template
• RDP disabled on workstations that do not need it
• "Allow log on through Remote Desktop Services" limited to admin groups per tier
• Local admin accounts denied RDP logon (S-1-5-114)
• Firewall rules scoped to admin networks
• Session time limits and redirection restrictions on servers
• 4624 type 10, 1149 and LocalSessionManager events collected and alerted

These settings protect the server from the network. To protect the administrator from a compromised server, continue with Restricted Admin and Remote Credential Guard.