Step-by-Step Guide to Setting Up a Private Windows RDP

Remote Desktop Protocol (RDP) lets you log into a Windows machine and use it as if you were sitting in front of it—apps, files, services, all accessible over an encrypted connection. A Private Windows RDP goes a step further: you get your own dedicated environment (VPS or dedicated server) with administrator control, predictable performance, and isolation from other users. In this hands-on guide, you’ll learn exactly how to plan, deploy, harden, and maintain a private Windows RDP from scratch. I’ll also point out practical shortcuts where a managed provider like 99RDP can save you time and headaches.

What you’ll accomplish

By the end, you will:

• Choose the right server type/specs for your needs

• Provision a Windows Server instance and connect via RDP

• Create a secure admin workflow and standard user accounts

• Lock down the firewall, enable NLA, and restrict who can log in

• Optionally change the default RDP port and add IP allowlists

• Set performance, reliability, and backup basics

• Troubleshoot common RDP errors like “NLA required” and session lockouts

Prerequisites

• A Windows Server image (2019 or 2022 recommended) on a VPS or dedicated server.

  • If you don’t want to manage licensing/activation or base hardening yourself, consider a ready-to-use plan from 99RDP with Windows pre-installed.

• Static public IP address (or a DNS record pointing to it).

• A strong admin password (12+ chars, mixed case + numbers + symbols) or a secure password manager.

• A local RDP client:

  • Windows: Built-in “Remote Desktop Connection” (mstsc)

  • macOS: Microsoft Remote Desktop (free on App Store)

  • Linux: Remmina or xfreerdp

Step 1: Choose the right server and OS

VPS vs Dedicated:

• VPS (most common): Affordable, fast to deploy, scalable. Perfect for one to a handful of users and typical workloads (office apps, development tools, small databases, trading terminals).

• Dedicated server: Maximum isolation and performance for heavy apps (video encoding, large databases, enterprise tools).

Minimum specs (typical):

• 2 vCPU / 4 GB RAM / 60–80 GB SSD for light desktop use or single-purpose apps

• 4 vCPU / 8–16 GB RAM / 120–200 GB SSD for multi-user or heavier workloads

• Add more CPU/RAM if you’ll run browsers with many tabs, IDEs, databases, or multiple concurrent sessions.

Windows version:

• Windows Server 2022 (most modern, long support) or 2019 (very stable, widely supported).

• If you need GUI + multi-user access, Windows Server is the right choice. (Windows 10/11 Pro allows only one remote user and is not designed for multiple concurrent users.)

Tip: Managed Private Windows RDP plans from 99RDP typically ship with Windows installed, activated, and tuned so you can skip ahead to login and hardening.

Step 2: Provision the server

1. Create the VM/server from your provider dashboard. Choose the Windows Server image.

2. Wait for the initial build and note:

   • Public IP address

   • Administrator username (usually Administrator)

   • Initial password (or the rescue/console method to set it)

3. Optional but recommended: Create a DNS record (e.g., rdp.yourdomain.com) pointing to the public IP for easier logins.

If you use 99RDP, you’ll typically receive the IP, username, and password immediately after provisioning. You can often request pre-hardening (firewall rules, NLA, and updates) right away.

Step 3: First login from your computer

On Windows:

1. Press Win + R, type mstsc, press Enter.

2. Enter IP_or_DNS:3389 (3389 is the default RDP port).

3. Click Show Options → General → enter username Administrator and the password.

4. Connect and accept the certificate prompt.

On macOS:

1. Install Microsoft Remote Desktop from the App Store.

2. Add a PC → enter IP/DNS and username.

3. Save and connect; accept the certificate prompt.

On Linux:
Use Remmina or xfreerdp:

xfreerdp /v:YOUR.IP.ADDR:3389 /u:Administrator

Once you’re in, let Windows finish any “first boot” tasks and updates. Don’t start installing apps yet—secure it first.

Step 4: Enable RDP (verify) and Network Level Authentication (NLA)

Most Windows Server images have RDP enabled by default. Verify:

GUI path:

• Open Server Manager → Local Server → Remote Desktop → Enable.

• Check Allow remote connections to this computer and Allow connections only from computers running Remote Desktop with Network Level Authentication (recommended).

PowerShell (run as Administrator):

# Enable RDP
Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' `
  -Name "fDenyTSConnections" -Value 0

# Enable Windows Firewall rule for RDP
Enable-NetFirewallRule -DisplayGroup "Remote Desktop"

# Enforce NLA
Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' `
  -Name "UserAuthentication" -Value 1

NLA prevents unauthenticated sessions from reaching the logon screen, significantly reducing brute-force risk.

Step 5: Create a new admin account and lock down “Administrator”

Attackers love the default Administrator username. The safer pattern is:

1. Create a new admin user with a unique name:

   • Computer Management → Local Users and Groups → Users → New User…

   • Create YourAdminName with a strong password.

   • Right-click the user → Properties → Member Of → Add… → Administrators.

2. Disable or rename the built-in Administrator account:

   • Right-click Administrator → Rename or set Account is disabled in Properties.

3. Create standard (non-admin) users for day-to-day tasks and add them to the Remote Desktop Users group:

   • Command (PowerShell/cmd):

     net localgroup "Remote Desktop Users" yourstandarduser /add
     

   • Or via GUI: User Properties → Member Of → add Remote Desktop Users.

This way, only intended users can RDP in, and admin privileges aren’t used unnecessarily.

Step 6: Tighten the Windows Firewall and (optionally) restrict by IP

Baseline rule: Confirm the inbound Remote Desktop rule is enabled for TCP 3389 (and UDP 3389 for modern RDP performance).
Stronger posture:

• In Windows Defender Firewall with Advanced Security, edit the RDP rule → Scope tab → set Remote IP addresses to These IP addresses and list your office/home/static IPs.

• If you don’t have static IPs, consider a VPN (WireGuard/OpenVPN) or an RD Gateway. Managed providers like 99RDP can help set these up quickly.

If you restrict by IP and your IP changes, you’ll lock yourself out. Keep out-of-band access (provider console) handy.

Step 7: (Optional) Change the default RDP port

Changing the RDP port can cut noise from automated scans. It’s not a substitute for NLA and strong passwords, but it helps.

Registry method (reboot required):

1. Run regedit.

2. Go to:

   HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
   

3. Edit PortNumber (DWORD), choose Decimal, set a new port (e.g., 49200).

4. Update the firewall: create a new inbound rule for your new TCP port (and UDP).

5. Reboot the server.

6. Next time you connect, use IP_or_DNS:49200.

Make sure the port isn’t blocked upstream by your hosting provider. With 99RDP, you can ask support to open/allow custom ports if needed.

Step 8: Certificates (remove the warning)

RDP will use a self-signed cert by default, causing a warning at first connect. To eliminate it:

1. Get a valid TLS certificate (from your CA or your provider).

2. Import into Local Computer → Certificates → Remote Desktop → Certificates.

3. In Remote Desktop Services configuration (or Group Policy), bind the cert to RDP.

This step is optional but a nice polish—especially for teams and clients.

Step 9: Performance tuning essentials

• High Performance power plan:
  Power & sleep settings → Additional power settings → High performance.

• Visual effects:
  System Properties → Advanced → Performance → Adjust for best performance (or at least disable animations/transparencies).

• Disk I/O:
  Prefer SSD/NVMe; keep 15–20% free space.

• Background services:
  Disable unneeded startup apps/services via Task Manager → Startup apps.

• Bandwidth:
  If multiple users connect, consider upgrading bandwidth or enabling a VPN/Gateway to stabilize latency.

Managed plans from 99RDP often pre-apply sensible performance defaults so you get a snappy desktop from day one.

Step 10: Updates, antivirus, and backups

• Windows Update: Enable automatic updates (maintenance window if this is production).

• Microsoft Defender: Keep real-time protection on; add exclusions only if necessary (e.g., for specific workloads).

• Backups/Snapshots:

  • Enable provider snapshots before big changes.

  • Schedule file-level backups for important data.

  • Test restoration periodically.

Providers like 99RDP can bundle snapshot/backup options and advise on retention (e.g., daily + weekly).

Step 11: Install apps and set policies

• Install your desktop apps (Office, IDEs, trading platforms, browsers, etc.).

• Group Policy hardening (gpedit.msc or domain GPO if applicable):

  • Account Lockout Policy: Lock after 5 invalid attempts, 15–30 min reset.

  • Password Policy: Minimum length 12+, complexity enabled, 90-day rotation (or longer with 2FA).

  • Clipboard/Drive Redirection: Restrict if you handle sensitive data.

• User profiles: Keep admin and user app footprints separate.

Step 12: Optional multi-user licensing (RDS)

Windows Server allows 2 simultaneous administrative sessions. If you need more concurrent users for normal work, you must deploy Remote Desktop Services (RDS) and purchase RDS CALs. This involves:

• Installing RDS roles (Connection Broker, Session Host, Licensing)

• Activating your licensing server

• Assigning per-user or per-device CALs

If licensing feels daunting, choose a managed Private Windows RDP plan from 99RDP that clearly states what concurrency you get and how licensing is handled.

Step 13: Monitoring and logs

• Event Viewer:

  • Applications and Services Logs → Microsoft → Windows → TerminalServices-* for connection/authentication events.

• Audit policy: Enable logon success/failure auditing via Local Security Policy → Advanced Audit Policy Configuration.

• Alerts: If your provider supports it, configure alerts on CPU, RAM, disk, and failed login spikes.

Troubleshooting: fast fixes to common issues

1) “The remote computer requires Network Level Authentication (NLA)”

• Use a modern client (Windows 10/11 mstsc, updated macOS RD app).

• If you must temporarily disable NLA (not recommended long-term), from the console:

  Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' `
    -Name "UserAuthentication" -Value 0
  

  Re-enable it after you fix the client side.

2) Can’t connect (timeout)

• Verify the server is up (provider console).

• Check firewall rules for TCP/UDP 3389 (or your custom port).

• If you changed the port, confirm the registry and firewall match.

• Test with Test-NetConnection your.ip.addr -Port 3389 from another Windows machine.

3) Black screen after login

• Wait 30–60 seconds; first-time profile creation can be slow.

• Update display drivers / Windows Update.

• Disable bitmap caching in the client options; try a smaller resolution.

• Check if explorer.exe launches (Task Manager → Run new task → explorer.exe).

4) “Another user is signed in” / stuck sessions

• From console or an admin RDP:

  quser
  logoff <SESSION_ID>
  

  or

  rwinsta <SESSION_ID>
  

5) Account lockouts

• Use the provider console to sign in and reset passwords.

• Review the event logs for brute-force attempts; tighten firewall IP scope.

Security checklist (print this!)

• New, strong admin user created; built-in Administrator disabled/renamed

• NLA enforced

• Firewall allows only required ports; RDP allowed only from trusted IPs or via VPN/Gateway

• (Optional) RDP port changed and firewall updated

• Windows Update enabled; Defender running

• Regular snapshots/backups scheduled and tested

• Account lockout + password policies configured

• Event logs monitored; alerts for failed logins

• RDS licensing in place if you need >2 concurrent non-admin sessions

When to consider a managed Private Windows RDP (and why 99RDP helps)

Running RDP securely isn’t “set and forget.” Patching, monitoring, backups, and user management take time—especially if you’re juggling customer work or trading windows. A managed provider like 99RDP can:

• Deliver a pre-hardened Windows environment (NLA, firewall, updates)

• Provide clean, static IPs and quick scaling (CPU/RAM/disk)

• Help with custom ports, VPN/gateways, and IP allowlists

• Offer fast support when you’re locked out or hit odd errors

• Bundle backups/snapshots and performance tuning from day one

If you want the benefits of a private desktop without the maintenance overhead, a Private Windows RDP plan from 99RDP is a strong shortcut.

Final thoughts

A Private Windows RDP is one of the most versatile tools you can deploy—remote work, development, secure app hosting, trading, or simply keeping a persistent Windows desktop in the cloud. Follow the steps above—enable NLA, reduce attack surface, keep backups—and you’ll have a fast, secure, and reliable environment you can count on. And if you’d rather skip straight to a production-ready setup, check out 99RDP to get a hardened Private Windows RDP with expert support behind it.