RDP setup and hardening checklist for Windows 10 and 11

A new Windows desktop is at its most vulnerable in its first hour, when it has a default configuration, an open port and no monitoring. This checklist covers that hour: security first, then performance, then the workflow setup that keeps a residential IP usable for months instead of weeks. Work through it in order — each section assumes the previous one is done.

1. Lock down how the machine is reached

Internet-wide scanners find a fresh 3389 within minutes of it opening. Credential-stuffing follows automatically. Before anything else, close that door.

Best: a gateway or VPN

Put an authenticated hop in front of the desktop so RDP is never directly reachable. Remote Desktop Gateway tunnels RDP inside HTTPS on 443 and enforces policy centrally. A WireGuard or IPsec tunnel achieves the same by making the desktop reachable only from inside the tunnel. Either way, the internet sees a hardened endpoint rather than a Windows logon prompt.

Minimum: allowlist plus a non-default port

If you must expose RDP directly, restrict it to known source addresses and move it off 3389. This does not make the service secure, but it removes it from the untargeted scanning that drives most compromises.

# Change the listening port (example: 34117)
Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' `
                 -Name PortNumber -Value 34117

# Remove the default wide-open rules
Get-NetFirewallRule -DisplayGroup "Remote Desktop" | Disable-NetFirewallRule

# Allow only your own addresses, on the new port
New-NetFirewallRule -DisplayName "RDP restricted" -Direction Inbound `
  -Protocol TCP -LocalPort 34117 -Action Allow `
  -RemoteAddress 203.0.113.14,198.51.100.0/24

Restart-Service TermService -Force   # this drops your current session

2. Authentication

• Network Level Authentication (NLA) — requires the client to authenticate before a session is created, which blocks pre-auth attacks outright.
• Multi-factor authentication — via the gateway, or with a Windows credential provider. This is the single highest-value control on the list.
• Rename the administrator account — half of automated attacks only ever try Administrator.
• Long passphrases — 16+ characters, unique to this host, stored in a password manager.
• Account lockout — a short window of attempts makes online brute force impractical.

# Require NLA
Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' `
                 -Name UserAuthentication -Value 1

# Highest encryption level
Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' `
                 -Name MinEncryptionLevel -Value 3

# Lockout: 5 attempts, 30-minute lockout, 30-minute counter reset
net accounts /lockoutthreshold:5 /lockoutduration:30 /lockoutwindow:30

# Rename the built-in administrator
Rename-LocalUser -Name "Administrator" -NewName "svc_op01"

# Work as a standard user; elevate only when needed
New-LocalUser -Name "work" -Password (Read-Host -AsSecureString) -FullName "Daily use"
Add-LocalGroupMember -Group "Remote Desktop Users" -Member "work"

3. Patching and baseline hardening

RDP has had serious pre-authentication vulnerabilities — BlueKeep (CVE-2019-0708) and the DejaBlue family among them. An unpatched host with an exposed port is a matter of when, not if.

# Install everything, now
Install-Module PSWindowsUpdate -Force -Scope AllUsers
Get-WindowsUpdate -AcceptAll -Install -AutoReboot

# Keep it that way
Set-Service -Name wuauserv -StartupType Automatic

# Turn off legacy protocols and services you will not use
Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol -NoRestart
Set-SmbServerConfiguration -EnableSMB1Protocol $false -Force

# Defender: real-time on, definitions current
Set-MpPreference -DisableRealtimeMonitoring $false
Update-MpSignature

Turn off what you will not use

• Clipboard redirection, drive redirection and printer redirection — each is a data path between the desktop and your local machine. Leave on only what you need.
• Remote Assistance, if you are not using it.
• Windows Script Host, if nothing on the machine requires it.

# Disable drive and printer redirection (keep the clipboard if you need it)
$rdp = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services'
New-Item -Path $rdp -Force | Out-Null
Set-ItemProperty -Path $rdp -Name fDisableCdm  -Value 1   # drives
Set-ItemProperty -Path $rdp -Name fDisableCpm  -Value 1   # printers
# Set-ItemProperty -Path $rdp -Name fDisableClip -Value 1  # clipboard

4. Making the session feel fast

Most complaints about sluggish RDP are configuration problems, not bandwidth problems. Three settings account for nearly all of it.

Enable the UDP transport

RDP 8.0 and later can use UDP alongside TCP, which dramatically improves responsiveness on links with any packet loss. It is often disabled by policy.

$ts = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services'
Set-ItemProperty -Path $ts -Name fClientDisableUDP -Value 0
# Allow UDP 3389 (or your custom port) through the firewall as well

Match visual settings to the link

You can set all of it in an .rdp file and reuse it:

full address:s:203.0.113.10:34117
username:s:work
session bpp:i:32
connection type:i:6
networkautodetect:i:1
bandwidthautodetect:i:1
redirectclipboard:i:1
redirectprinters:i:0
drivestoredirect:s:
audiomode:i:2
disable wallpaper:i:1
disable full window drag:i:1
disable menu anims:i:1
allow font smoothing:i:1
bitmapcachepersistenable:i:1
autoreconnection enabled:i:1

Confirm the transport is actually being used

In an active session, the connection-quality indicator in the RDP title bar reports protocol and round-trip time. If it reports TCP only, UDP is being blocked somewhere on the path — usually a firewall rule you have not written yet.

5. Browser and identity hygiene

This is where residential IPs are most often wasted. The address is clean; the browser configuration is not.

• One profile per identity. Chrome and Edge both support separate profiles with separate cookie jars, storage and extensions. Never work two unrelated accounts in one profile.
• Set the system timezone to match the exit IP's city. A Chicago address with a Central European timezone is a contradiction detection systems specifically look for.
• Set the system locale and keyboard layout to match too — navigator.languages follows the OS.
• Keep the clock accurate. Enable the Windows time service and verify sync.
• Skip exotic anti-fingerprint extensions. They usually make you more unusual, not less. Stock Chrome on stock Windows is the crowd you want to hide in.

# Timezone and time sync
Set-TimeZone -Id "Central Standard Time"
w32tm /resync /force
w32tm /query /status

# Confirm locale
Get-WinSystemLocale
Set-WinSystemLocale -SystemLocale en-US   # requires a reboot

:: Launch a named Chrome profile from a desktop shortcut
"C:\Program Files\Google\Chrome\Application\chrome.exe" ^
  --profile-directory="Profile-ClientA"

The reasoning behind each of these is set out in proxy security and anonymity.

6. Verify the IP before you build on it

Do this on day one, before you invest hours configuring accounts on an address that was already burned.

1. Confirm the public address matches what the provider promised, over both IPv4 and IPv6.
2. Check the ASN and confirm it belongs to a consumer ISP, not a hosting provider.
3. Compare the reported geolocation across two or three databases.
4. Check the address against the blocklists relevant to your targets.
5. Load your two or three most important targets and record whether you are challenged.
6. Confirm there is no DNS or WebRTC leak from inside the desktop.

Our privacy check page reports the browser-side half of this locally, with no data leaving the machine.

7. Monitoring and audit

You cannot respond to what you cannot see. Turn on logon auditing and know where to look.

# Audit both successful and failed logons
auditpol /set /subcategory:"Logon" /success:enable /failure:enable

# Recent failed logons (4625) — spikes mean someone is knocking
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625} -MaxEvents 40 |
  Select-Object TimeCreated,
    @{n='User'; e={$_.Properties[5].Value}},
    @{n='From'; e={$_.Properties[19].Value}}

# Successful RDP logons (type 10)
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624} -MaxEvents 40 |
  Where-Object { $_.Properties[8].Value -eq 10 } |
  Select-Object TimeCreated, @{n='User'; e={$_.Properties[5].Value}}

# Who is connected right now?
quser
qwinsta

Set a weekly reminder to review failed-logon counts and active sessions. Five minutes a week catches things that would otherwise be discovered by accident.

8. Backups and recovery

• Snapshot after the initial hardening, then on a schedule that matches how much work you would accept losing.
• Export browser profiles and any critical configuration to encrypted off-host storage.
• Keep a plain-text runbook of the setup so a rebuild is a checklist, not archaeology.
• Test a restore. An untested backup is a hypothesis about a backup.

Quick reference: the whole checklist

Common problems and their real causes

"The session lags even though my connection is fast"

Almost always UDP being blocked, forcing everything over TCP. Check the connection-quality indicator; if it says TCP only, open UDP on your custom port. Second most common cause: 32-bit colour with all visual effects on over a 150 ms link.

"I keep getting logged out"

Idle session limits in Group Policy, or a second sign-in with the same account displacing the first (a Windows client licence allows one interactive session). Check Computer Configuration → Policies → Administrative Templates → Windows Components → Remote Desktop Services → Session Time Limits.

"Sites started challenging me after a week"

Either the address picked up reputation damage from your own volume, or your fingerprint and geography disagree. Check the timezone first — it is the most frequently overlooked mismatch — then review request volume against what a household would plausibly generate.

"Copy and paste stopped working"

Restart rdpclip.exe inside the session. If it happens repeatedly, clipboard redirection is being reset by policy.

taskkill /f /im rdpclip.exe
start rdpclip.exe

Thirty minutes now, months of uptime later

Every item above takes a few minutes. Together they turn a default Windows box — which is a target — into a machine that is boring to attackers and pleasant to work on. Do them in order, snapshot when you are finished, and write down what you changed.

For background on why the IP layer matters at all, start with the complete residential RDP guide. Ready-configured desktops are listed on the Residential RDP page.