Prerequisites
- Administrator access
- A maintenance window
- A tested recovery route such as the provider console
Security note
Firewall and Remote Desktop policy changes can lock you out. Keep a recovery console open and test a second session before closing the first one.
Step 1
Replace temporary credentials
Use a long, unique password and store it in a password manager. Create named accounts for each administrator instead of sharing one login.
Step 2
Install operating system updates
Run Windows Update, apply security updates, reboot if required, and repeat the update check until no applicable security updates remain.
Step 3
Reduce Remote Desktop exposure
Allow RDP only from trusted source addresses when possible. Enable Network Level Authentication and remove unused local accounts from the Remote Desktop Users group.
Step 4
Review firewall and services
Keep the Windows firewall enabled. Remove inbound rules and disable services that the workload does not require.
Step 5
Configure protection and logging
Keep Microsoft Defender or another supported security product active, review event logs, and alert on repeated authentication failures.
Step 6
Create and test backups
Back up application data and configuration outside the server. Test that a sample file or application state can be restored.
Troubleshooting
- RDP stops working after a firewall change
- Use the provider console or recovery route, verify the Remote Desktop firewall group, and narrow the source rule only after access is restored.
- Updates remain pending
- Reboot during the maintenance window and run the update check again. Review Windows Update history for a specific failure code.
Frequently asked questions
Does changing the RDP port secure the server?
It can reduce routine scanning noise but is not a substitute for source restrictions, strong authentication, patching, and monitoring.