How to Enable RDP on Windows Server 2016–2025

Enabling RDP on Windows lets you manage a Windows Server VPS from a Remote Desktop client instead of its browser console. Use the VPS console to turn on the service, allow the built-in firewall rules, and test a fresh connection in about ten minutes.

Prerequisites

• A Windows Server VPS running 2016, 2019, 2022, or 2025, or Windows 10/11 Pro or Enterprise. Windows Home editions cannot accept incoming RDP connections.
• Access to the VPSLake client area and the VPS control panel (Virtualizor), including its VNC/console option. Keep this out-of-band session open until the new RDP login works.
• A local administrator account, its current password, and permission to open an elevated PowerShell window. Use a separate named account for daily work when possible.
• The server’s public IP address and a separate computer with the Microsoft Remote Desktop client for the connection test.
• If you need a Windows VPS with administrator access, see VPSLake Windows RDP hosting.

Step 1: Open the Windows console from the VPS panel

You need console access because RDP is unavailable until Windows is configured to accept it.

Sign in to the VPSLake client area, open the VPS service, and choose the link that opens the VPS control panel (Virtualizor). Select the VPS, then open VNC/Console. Sign in to Windows locally with an administrator account.

Do not close the console or reboot the VPS yet. If a firewall or account change is wrong, the console is your recovery route.

Step 2: Enable Remote Desktop and its firewall rules

The Remote Desktop setting changes whether Windows accepts terminal sessions; the firewall rule controls whether those sessions can reach the server.

Open Windows PowerShell → Run as administrator from the console. Run these commands one at a time:

$TerminalServerKey = 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server'
Set-ItemProperty -Path $TerminalServerKey -Name fDenyTSConnections -Value 0
Set-Service -Name TermService -StartupType Automatic
Start-Service -Name TermService
Enable-NetFirewallRule -DisplayGroup 'Remote Desktop'

The commands normally return to the prompt without an error. The last command enables Windows’ existing Remote Desktop rules rather than opening every inbound port. On a non-English installation, use the graphical firewall method in Step 3 if the English display-group name is not found.

To confirm the important settings before leaving the console, run:

Get-ItemProperty -Path $TerminalServerKey -Name fDenyTSConnections
Get-Service -Name TermService | Select-Object Name,Status,StartType
Get-NetFirewallRule -DisplayGroup 'Remote Desktop' | Where-Object Enabled -eq 'True' | Select-Object -First 3 DisplayName,Enabled,Profile,Direction,Action

Expected output includes fDenyTSConnections : 0, Status set to Running, and enabled inbound rules with Action set to Allow:

fDenyTSConnections : 0
Name        Status  StartType
----        ------  ---------
TermService Running Automatic

Microsoft describes the Remote Desktop access setting in its Remote Desktop allow-access documentation.

Step 3: Check the settings in the Windows interface

The graphical path helps you confirm that Network Level Authentication and the correct firewall profile are being used.

Open Server Manager → Local Server → Remote Desktop. Select Enabled, choose Allow remote connections to this computer, and keep Allow connections only from computers running Remote Desktop with Network Level Authentication selected. Select Apply and OK.

Next open Server Manager → Tools → Windows Defender Firewall with Advanced Security → Inbound Rules. Find the rules whose names begin with Remote Desktop, confirm they are enabled, and confirm their Profile includes the active network profile. Do not disable Windows Defender Firewall to solve an RDP problem.

If this is a Windows client edition rather than Server, use Start → Settings → System → Remote Desktop, turn on Remote Desktop, and accept the confirmation. Windows must be Pro or Enterprise; Home does not provide the incoming RDP host.

Step 4: Authorize the account that will connect

Administrators can normally connect, while a standard account must be a member of the local Remote Desktop Users group.

For a standard local account, open Computer Management → Local Users and Groups → Groups → Remote Desktop Users. Select Add, enter YOUR_USERNAME, choose Check Names, and select OK. If the account is from a domain, use DOMAIN\YOUR_USERNAME instead.

You can make the same membership change from elevated PowerShell for a local account:

$UserName = 'YOUR_USERNAME'
Add-LocalGroupMember -Group 'Remote Desktop Users' -Member $UserName
Get-LocalGroupMember -Group 'Remote Desktop Users' | Select-Object Name,PrincipalSource

The final command should list the account. Replace YOUR_USERNAME with the real account name; do not paste the placeholder or a password into a command.

Verify the RDP connection

First verify the listener from the Windows console. The default RDP endpoint is TCP 3389 unless you deliberately changed it:

Get-NetTCPConnection -LocalPort 3389 -State Listen | Select-Object LocalAddress,LocalPort,State,OwningProcess

Expected output has a Listen row, commonly bound to 0.0.0.0 or the server’s address:

LocalAddress LocalPort State  OwningProcess
------------ --------- -----  -------------
0.0.0.0           3389 Listen          1180

From a different Windows computer, test the public address rather than localhost:

Test-NetConnection -ComputerName SERVER_IP -Port 3389

Replace SERVER_IP with the VPS public IP or DNS name. A successful result contains:

ComputerName     : SERVER_IP
RemotePort       : 3389
TcpTestSucceeded : True

Now launch Remote Desktop Connection, enter SERVER_IP in Computer, select Connect, and sign in with SERVER_NAME\YOUR_USERNAME or .\YOUR_USERNAME for a local account. Keep the Virtualizor console open until this new session reaches the desktop.

Troubleshooting

TcpTestSucceeded : False

The service may not be listening, the Windows rule may be disabled for the active profile, or a provider-side firewall may be blocking TCP 3389. From the console, rerun the listener and service checks, review Windows Defender Firewall with Advanced Security → Inbound Rules, and check any firewall or security-group settings in the VPS control panel.

The RDP client says the connection is refused

Windows is reachable, but Remote Desktop Services is not accepting connections on the requested port. Run Get-Service TermService in elevated PowerShell, start it if necessary, and confirm that the client is using the correct address and port. If you changed the RDP port previously, test that port instead of assuming 3389.

The account is rejected even though RDP is enabled

The account may have a wrong password, be disabled, lack the Allow log on through Remote Desktop Services right, or not belong to Remote Desktop Users. Recheck group membership, local security policy, and the account name format; do not weaken the policy by enabling blank passwords.

The client fails during Network Level Authentication

Update the RDP client and make sure the server has current Windows updates. An old client or a CredSSP/security-policy mismatch can fail before the credential screen; use the Virtualizor console to repair the client or policy. Only as a temporary compatibility test, clear the NLA checkbox under Server Manager → Local Server → Remote Desktop, reconnect, and turn NLA back on immediately after testing.

Hardening

• Keep Network Level Authentication enabled and use a long, unique password for every administrator account.
• Restrict the Remote Desktop firewall rules to trusted source IP addresses or a VPN when your network design allows it; exposing 3389 to the whole internet increases scan and login noise.
• Create a separate named administrator account for routine work and monitor failed logons in Event Viewer → Windows Logs → Security.
• Keep the Virtualizor console available as a recovery channel, but do not leave a browser console session unattended.

FAQ

Can I enable RDP without an existing RDP session?

Yes. Use the VPS control panel’s VNC/console connection to reach Windows locally, then enable Remote Desktop and its firewall rules. This is why you should not depend on RDP as your only recovery path.

What is the default Windows RDP port?

The default is TCP 3389. A different port does not provide strong security by itself; if you change it, update the Windows firewall rule, any provider firewall, and the client address together.

Does enabling RDP disable the VPS console?

No. RDP and the Virtualizor console are separate access methods. Keep the console available for recovery when a firewall, network, service, or credential change prevents an RDP login.

Can Windows Home accept incoming RDP connections?

No. Windows Home does not include the Remote Desktop host feature. Use a supported Pro or Enterprise client edition, or Windows Server, for incoming RDP access.