What Is an RDP VDS? Remote Desktop Server Setup and Security

An RDP VDS is a virtual server running Windows that you reach over the Remote Desktop Protocol. You open a window on your own computer, see the desktop of a machine sitting in a data center, and use it as if it were in front of you. This guide explains what an RDP VDS actually is, who benefits from one, how to size it for your workload and, most importantly, how to protect an internet-facing remote desktop from attack, one step at a time.

What is an RDP VDS, and is it different from a regular VDS?

Technically there is no separate product category. A VDS is a virtual server created by dividing a physical machine with KVM virtualization, with its own CPU cores, RAM, disk and IP address. Once Windows is installed on it, the natural way to manage it is Remote Desktop, so people simply call it an RDP VDS or an RDP server. You reach a Linux VDS through SSH on the command line; you reach a Windows one through RDP with a full graphical desktop. The difference lies in the operating system and the way you connect, not in the hardware.

RDP is built into Windows and listens on port 3389 by default. You do not need extra software on the client side: Windows ships with Remote Desktop Connection (mstsc), Microsoft publishes official apps for macOS, Android and iOS, and Linux users typically rely on clients such as Remmina.

What separates an RDP VDS from remoting into an office PC is continuity. The server runs around the clock on redundant power and network infrastructure, and when you close the connection your session and your running programs stay exactly where you left them.

Who uses an RDP VDS?

The range of uses is wider than most people expect. These are the scenarios we see most often:

• Accounting and bookkeeping software: the application is installed once, and branch offices, the external accountant and staff working from home all use the same data.
• Software that has to run around the clock: automated trading tools, marketplace integrations, stock and price synchronization, scheduled reports. Instead of leaving a home PC switched on, you run them on a server.
• Remote teams: company data does not spread across personal laptops; everyone works on the server desktop and the data stays in one place.
• Development and testing: trying out an ASP.NET application on IIS, a SQL Server database, or a tool that only runs on Windows.
• Work that requires a fixed IP: when a bank, an e-invoicing provider or a supplier portal only accepts connections from a registered address, the team works from one desktop with a static IP.
• People with underpowered computers: the heavy application runs on the server and the local machine only displays the screen.

How much capacity do you need?

The Windows graphical interface needs more memory than a headless Linux system. The operating system alone takes a few gigabytes of RAM, and your applications come on top of that. Treat the table below as a starting point rather than a precise rule. Because a KVM-based VDS can be upgraded later, the sensible approach is to start small and watch actual resource usage.

For storage, set aside at least 50-60 GB for the operating system and its updates; SSD or NVMe storage noticeably shortens sign-in and application start-up times. For many concurrent users or heavy databases, dedicated server options may be a better fit. If you are undecided, see our comparison of virtual and dedicated servers.

Which Windows version should you choose?

SistemDC installs Windows Server 2016, 2019, 2022 and 2025 as well as Windows 11 from ready-made images. Work through these questions in order:

1. What does your software support? Vendors of accounting and ERP packages publish the versions they support. Check that first.
2. How long will it be supported? For a new installation, choose a current release wherever you can. According to Microsoft's lifecycle documentation, extended support for Windows Server 2016 ends on January 12, 2027; installing a release that will soon stop receiving security updates on an internet-facing server makes little sense today.
3. How many users? If several people will work at the same time, you need Windows Server. Windows 11 is a single-user desktop experience.

For most new deployments Windows Server 2022 or 2025 is the right choice. For a closer look, read the Windows Server 2022 VDS guide and the Windows Server 2025 VDS guide.

How many people can connect at once? Licensing in brief

This is the most commonly misunderstood point. Windows Server allows two simultaneous remote sessions for administration. Two people managing the server can therefore connect without any extra setup.

If three or more people need to work at the same time, or the server is going to act as a shared desktop for a team, you must install the Remote Desktop Services (RDS) role and obtain an RDS client access license (CAL) for each user or device. Licensing rules are set by Microsoft and can change over time; check Microsoft's RDS licensing documentation for the current terms. Settling your user count before you pick a plan makes both capacity and licensing easier to get right.

How to connect to an RDP VDS

1. When your server is provisioned you receive its IP address, user name and password.
2. On Windows, press Win + R, type mstsc and press Enter.
3. Enter the IP address in the Computer field. If you have changed the port, use the form IP:port.
4. Enter the user name and password. On the first connection you will see a certificate warning; accept it once you have confirmed the IP address is correct.
5. Make changing the password the first thing you do after signing in.

Closing the window does not end the session; your programs keep running. To list open sessions on the server, run:

quser

RDP VDS security: a 10-step checklist

An open port 3389 is one of the targets automated scanners probe most. It is normal for a newly installed server to log hundreds of failed sign-in attempts within a few hours. The goal of those attempts is to guess a weak password and, more often than not, to plant ransomware afterwards. Everything below takes less than half an hour.

1. Allow RDP only from your own IP addresses

This is the single most effective measure. If your office has a static IP, narrow the firewall rule so that only that address is allowed. The example uses a documentation address; replace it with your own:

Set-NetFirewallRule -DisplayGroup "Remote Desktop" -RemoteAddress 203.0.113.10

If you do not have a static IP, the VPN approach in step 10 achieves the same result.

2. Keep Network Level Authentication (NLA) enabled

With NLA on, the server does not even create a sign-in screen until the user has authenticated, which reduces both resource use and attack surface. It is enabled by default on current releases, but verify it:

Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" -Name UserAuthentication -Value 1

3. Use strong passwords and a separate administrator account

Attack tools try the name "Administrator" first. Create a new administrator account with a different name or rename the built-in one, and set a password of at least 14 characters that is not a dictionary phrase and is not used anywhere else.

Rename-LocalUser -Name "Administrator" -NewName "server-admin"

For daily work, create separate accounts without administrator rights and add only the people who really need access to the Remote Desktop Users group.

4. Define an account lockout policy

Locking an account for a while after repeated wrong passwords makes brute-force attempts pointless. The following command locks an account for 30 minutes after 5 failed attempts:

net accounts /lockoutthreshold:5 /lockoutduration:30 /lockoutwindow:30

5. Change the default port (it is not enough on its own)

A custom port is not a security control, but it cuts out most automated scanning and keeps your logs readable. Order matters: add the firewall rule for the new port first, then change the port.

New-NetFirewallRule -DisplayName "RDP-Custom-TCP" -Direction Inbound -Protocol TCP -LocalPort 33890 -Action Allow
New-NetFirewallRule -DisplayName "RDP-Custom-UDP" -Direction Inbound -Protocol UDP -LocalPort 33890 -Action Allow
Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" -Name PortNumber -Value 33890
Restart-Service TermService -Force

Your connection drops when the service restarts; reconnect on the new port. If something goes wrong, you can reach the server screen through the console in the Client Area and fix the setting. Once you have confirmed the new port works, disable the old 3389 rules.

6. Do not postpone updates

Remote Desktop components have had serious vulnerabilities in the past that required no authentication at all. Keep Windows Update enabled, install the monthly security updates and schedule the restart outside working hours.

7. Limit idle sessions

Disconnected sessions left open for days consume memory and add risk. In gpedit.msc, go to Computer Configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Session Time Limits and set limits for idle and disconnected sessions. If a program has to run continuously, run it as a service or a scheduled task rather than leaving it tied to a session.

8. Review clipboard and drive redirection

By default your local drives and clipboard can be carried into the session. Malware that reaches the server can then reach your mapped local drives as well. If you do not need it, turn off drive redirection under Device and Resource Redirection in the same policy tree.

9. Watch the sign-in logs

Failed attempts are written to the Security log with event ID 4625 and successful sign-ins with 4624. For a quick look at the most recent failures:

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625} -MaxEvents 20 | Format-Table TimeCreated, Message -Wrap

If you see a successful sign-in from an address you do not recognize, change the passwords immediately and investigate the server.

10. Put RDP behind a VPN where possible

The most robust design is one where the RDP port is not exposed to the internet at all. You install a VPN such as WireGuard on the server or on a small separate VDS and allow RDP only from the VPN network. For teams without a static IP, working in the field or from home, this is the most practical answer. Larger multi-user environments should also consider Remote Desktop Gateway and multi-factor authentication.

Backups: the last layer of security

Despite every precaution, an account can be compromised, an update can break the system, or a user can delete the wrong folder. That is why backups belong on the security list:

• Do not keep the backup on the server's own disk. Ransomware encrypts backups stored on the same disk.
• For applications that use a database, copying files is not enough; use the backup function of the application or of SQL Server itself.
• Run a restore test a few times a year. A backup that has never been restored cannot be counted on.

SistemDC offers an optional, paid Backup Service add-on for VDS plans, which can be added at order time or later.

Checklist for choosing an RDP VDS

• Location: if your users are in Turkey, an Istanbul location gives lower latency, and on a remote desktop mouse and keyboard response depends directly on latency. If you need to be close to services in Europe, consider virtual servers located in Germany.
• Virtualization: full virtualization such as KVM keeps resources reserved for you and runs Windows without compromises.
• Console access: there should be a console that shows you the server screen when RDP is unreachable.
• Reinstallation: you should be able to reinstall the operating system yourself from the panel.
• Traffic terms: read what "unlimited" actually means. At SistemDC, VDS traffic is unlimited under a fair use policy: beyond 10 TB per month there is no extra charge, and the port speed is reduced to 100 Mbps.
• Support: being able to open a ticket at any hour makes a difference when an access problem appears outside office hours.

SistemDC VDS plans run in an Istanbul data center built to Tier 3 standards, on KVM virtualization with a 1 Gbps port; restart, reinstall and console operations are handled through the Client Area. For current plans and pricing, see the VDS hosting page.

Related Guides

• Windows VDS Guide 2026: RDP, IIS and SQL Server
• Windows Server 2022 VDS Selection and Setup Guide
• Windows Server 2025 VDS Selection and Setup Guide
• Server Running Slow? Find Performance Problems in 10 Minutes
• Windows VPS/VDS plans
• VDS hosting plans

Frequently Asked Questions