RDP exposed directly to the internet is one of the most reliably exploited misconfigurations in IT — ransomware groups scan for open port 3389 constantly. None of that means RDP itself is unsafe to use; it means it needs to be used correctly.
Never Expose Port 3389 Directly
Put RDP behind a VPN, or use Azure Bastion / a Remote Desktop Gateway if you need browser-based access without a client VPN. If you absolutely must allow direct access, at minimum change the listening port and restrict it by source IP at the firewall.
Enforce Network Level Authentication
NLA requires authentication to complete before a full RDP session is established, closing off a class of pre-auth attacks. It’s on by default in modern Windows, but worth confirming explicitly:
Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" <code> -Name "UserAuthentication" -Value 1 # Require strong encryption Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" </code> -Name "MinEncryptionLevel" -Value 3
Layer On Account Lockout and MFA
# Lock an account after 5 failed attempts for 30 minutes net accounts /lockoutthreshold:5 /lockoutduration:30 /lockoutwindow:30
For anything internet-facing, pair RDP with Azure MFA via a Remote Desktop Gateway, or use Windows Hello for Business — a compromised password alone should never be enough to get a remote desktop session.
Monitor for Brute-Force Attempts
Event ID 4625 (failed logon) spiking against your RDP-enabled hosts is the clearest early warning sign of an active brute-force attempt — worth alerting on, not just logging.