Windows VDS Setup and RDP Connection: Step-by-Step Guide
Quick answer
To connect to a Windows VDS, use Remote Desktop Connection (mstsc) on Windows or Microsoft's Windows App on macOS, iOS and Android, then enter the server IP, username and password. On first login, run Windows Update, set a strong password, keep Network Level Authentication on, restrict RDP to your own IP addresses in the firewall or at least move it off the default port, set an account lockout policy and create a separate user for daily work. Copy files with clipboard or drive redirection.
What do you need to connect to a Windows VDS?
You connect to a Windows VDS over the Remote Desktop Protocol (RDP). RDP shows the server's desktop on your screen and lets you use it with your own keyboard and mouse as if you were sitting in front of it. Three details are enough to connect: the server's IP address, a username and a password. Providers usually send these by email or show them in the customer panel after you order. RDP listens on port 3389 by default.
TheCrewHost's VDS plans support Windows with RDP access, and setup completes automatically after payment, so you can connect as soon as your login details arrive. Check the Windows Server edition and licensing details on the order page and in your provider's documentation. If you run a Linux VDS, you connect over SSH instead; this guide covers the Windows side. For the basics of what a VDS is, see our guide on that topic.
- The server's IP address and RDP port (3389 by default)
- The administrator username and initial password
- Remote Desktop Connection (mstsc), built into Windows
- Microsoft's Windows App on macOS, iOS and Android
- Your own public IP address, so you can restrict access
How do you connect over RDP from Windows?
On Windows the client is already installed. Press Win + R, type mstsc and press Enter, then type the server IP into the Computer field of the Remote Desktop Connection window. If you have changed the port, add a colon and the port number to the address, for example 203.0.113.10:3390. When you click Connect, you are asked for a username and password. When signing in with a local account on the server, putting .\ in front of the username tells Windows to look the account up on that machine.
On the first connection it is normal to see a warning that the server's certificate cannot be verified, because the server uses a self-signed certificate. If you are sure you typed the right IP, you can continue. Under Show Options you can save the settings as an .rdp file so later connections take one click; it is safer to let Windows Credential Manager store the password than to save it inside that file.
If you manage several servers, the same window lets you set a display size, choose whether to use all your monitors and decide which local resources the session can reach. Keep redirection to what you actually use; every shared drive or device is one more path between your computer and the server.
How do you connect over RDP from a Mac, iPhone or Android?
On macOS, iOS, iPadOS and Android, Microsoft has replaced the old Microsoft Remote Desktop app with Windows App. Download it from the Mac App Store, the App Store or Google Play. Open it, choose Add PC from the plus menu, enter the server IP in the PC name field, with the port if you changed it, and add your user account. Once saved, tapping or clicking the server in the list starts the session.
On a phone the screen is small, so Windows App's touch mouse mode and on-screen keyboard help a lot. They are fine for restarting a service or checking on a process, though longer work is easier on a computer. On Linux, open-source clients such as Remmina or FreeRDP connect the same way.
How do you secure a Windows VDS on first login?
An RDP port open to the internet is a favourite target for automated password-guessing attacks, and it is not unusual to see failed sign-in attempts in a new server's event log within minutes. A few settings in your first session prevent most of the trouble you would otherwise face later. Start by running Windows Update, installing every update and restarting if asked.
Change the initial password straight away. Pick one of at least 14 characters that you use nowhere else, and keep it in a password manager. In System Properties, on the Remote tab, make sure the option to allow connections only from computers running Remote Desktop with Network Level Authentication (NLA) is ticked. NLA requires users to authenticate before a full session is created, which shrinks the attack surface the server exposes.
Turning off services you do not use narrows that surface further. Disabling the Print Spooler service on a server that never prints, for example, is a common recommendation. Do not switch off services you do not understand, though; stopping something without knowing what it does can break Windows components that depend on it.
Should you change the RDP port, and how do you restrict it by IP?
The most effective protection is making RDP reachable only from your own IP addresses. Open Windows Defender Firewall with Advanced Security, find the Remote Desktop - User Mode (TCP-In) rule under Inbound Rules, and add your IP addresses to the remote IP list on its Scope tab. If your home IP changes often, this can lock you out; in that case, connecting through a VPN and allowing RDP only from the VPN address is the sturdier option.
Moving RDP from 3389 to another port does not stop a determined attacker, but it filters out most of the automated scans that hit the default port and keeps your logs cleaner. According to Microsoft's documentation, the port is set by the PortNumber value in the RDP-Tcp registry key. Enter the new port in decimal, create inbound firewall rules for that port over both TCP and UDP, and only then restart the server. Do it in the opposite order and you lock yourself out.
Whichever method you use, keep your current session open and test the new setting from a second connection window. It also pays to find out in advance whether your provider offers a web console or another emergency access route, which can save hours if something goes wrong.
Why use a separate user and an account lockout policy?
The first username attackers try is Administrator. Create a new account with a different name for daily work. If your applications do not need admin rights, leave it as a standard user and add it to the Remote Desktop Users group, and keep a separate admin account with a strong password for management tasks. If you plan to disable the built-in Administrator account, first confirm that you can sign in with your other admin account.
An account lockout policy locks an account for a while after a set number of wrong passwords, which slows brute-force attacks down. Open Local Security Policy (secpol.msc) and, under Account Policies, Account Lockout Policy, set the threshold, the lockout duration and the time before the counter resets. Set the threshold too low and your own typos will lock you out; a handful of attempts with a sensible duration is a good balance. Depending on the Windows version, the built-in Administrator account may be exempt from lockout, which is another reason to use separate accounts.
What should you know about Windows Server licensing?
Windows Server is a paid operating system and must run with a valid licence. Whether the provider supplies the licence or the customer brings their own varies between companies and between plans, so before you order, ask your provider whether a licence is included and which edition is installed. Staying within the licence terms is a shared responsibility between provider and customer.
RDP has a licensing angle of its own. Windows Server allows two simultaneous remote sessions for administration without extra licences. If more people need to work on the server at the same time, you need the Remote Desktop Services (RDS) role plus per-user or per-device RDS client access licences (CALs). Install the RDS role without configuring a licence server and, once the grace period ends, connections start failing with a licensing error.
How do you copy files over RDP?
The simplest way is the shared clipboard. Clipboard redirection is on by default in mstsc, so you can copy a file on your computer and paste it into a folder on the server. That is ideal for small files, but it can be slow for large ones, and if the transfer breaks halfway you have to start again.
For bigger transfers, use drive redirection. In mstsc, go to Show Options, Local Resources, More, and tick the drive you want to share under Drives; once connected, it appears under This PC on the server. In Windows App, the same setting lives in the Folders section when you edit the PC. Share drives only while you need them, because if the server is ever compromised, that folder is reachable too. For very large files, cloud storage or an SFTP service running on the server is faster and more reliable.
How do you fix common RDP errors?
Most RDP errors fall into three groups: the server cannot be reached at all, authentication fails, or there is a session or licensing problem. If you cannot reach the server, check that it is running, that you typed the right IP and port, and that the firewall is not blocking you. If your credentials are rejected, check the username format and your keyboard layout; on a Turkish keyboard, mixing up ı and i is a classic cause of password errors.
A few settings also help performance. On the Experience tab, let RDP detect connection quality automatically and turn off the wallpaper and visual effects if needed. Opening the UDP port in the firewall as well lets RDP use its smoother UDP transport. If you run a bot or a long job, end your visit by closing the window rather than signing out: disconnecting leaves your apps running, while signing out closes them all.
| Error or symptom | Likely cause | Fix |
|---|---|---|
| Cannot connect to the remote PC (0x204 on macOS) | Wrong IP or port, firewall, server offline | Check the IP:port, the firewall rule and the server's status |
| Your credentials did not work | Wrong username format or password | Try the username as .\username and check your keyboard layout |
| CredSSP encryption oracle remediation error | Client and server updates out of step | Install Windows updates on both the server and your own PC |
| The account is locked out | Too many wrong attempts hit the lockout threshold | Wait for the lockout to expire or unlock it from another admin account |
| No Remote Desktop License Servers available | RDS role installed, grace period over | Configure RDS licensing or remove the RDS role |
| Black screen or frozen session | Display or session issue | Disconnect and reconnect, restart the server if needed |
Connect to a Windows VDS and secure it in 8 steps
- 1
Collect your connection details
Note the IP address, administrator username and initial password you received after ordering.
- 2
Make the first connection
Connect with mstsc on Windows or Windows App on macOS and mobile, and accept the certificate warning once you are sure the IP is right.
- 3
Install updates
Run Windows Update, install every available update and restart the server.
- 4
Change the password and check NLA
Replace the initial password with a long, unique one, and confirm NLA is enabled on the Remote tab of System Properties.
- 5
Create a separate user
Add a differently named account for daily work, put it in the Remote Desktop Users group and test that you can sign in with it.
- 6
Restrict RDP access
Limit the RDP firewall rule's scope to your own IP addresses or move RDP to another port; add the firewall rule first, then restart.
- 7
Set an account lockout policy
In secpol.msc, choose a sensible threshold of failed attempts and a lockout duration.
- 8
Trim services and plan backups
Disable services you do not use, such as Print Spooler on a server that never prints, and set up backups stored off the server.
Frequently Asked Questions
Does changing the RDP port make the server secure?
Not on its own. Moving the port filters out most of the automated scans aimed at 3389 and tidies your logs, but a targeted attacker will still find the open port. Real protection comes from a strong password, NLA, an account lockout policy and, above all, limiting RDP to your own IP addresses. Treat a port change as an extra layer on top of those.
How do I connect to a Windows VDS from a Mac?
Install Microsoft's Windows App from the Mac App Store; it replaced the old Microsoft Remote Desktop app. Use Add PC to enter the server IP, with the port if you changed it, add your user account and connect. To share files, redirect a folder to the server from the Folders section of the PC's settings.
Do programs on the server stop when I close the RDP window?
If you close the window, you only disconnect: the session stays alive on the server and programs keep running. If you choose Sign out from the Start menu, every program closes. For bots, trading software or long jobs, disconnect instead of signing out, and better still, run critical apps as a service or scheduled task so they start again on their own after a reboot.
How many people can use a Windows VDS at once?
Windows Server allows two simultaneous remote sessions for administration without extra licences. For more people to work at the same time, you need the Remote Desktop Services role and per-user or per-device RDS client access licences. If more than two people on your team will use the server at once, settle the licensing question with your provider before you start.
I locked myself out of the server. What now?
If a firewall rule or port change stopped you connecting, first try from a different network or on the old port. If your provider offers a web console or recovery access, sign in there and undo the change. If not, open a support ticket with the server IP and a description of what you changed. This is exactly why you test changes from a second session.
Why is my RDP connection slow or laggy?
The usual causes are high latency, low bandwidth and a server running out of resources. Choose a location close to you, turn off visual effects on the Experience tab and open RDP's UDP port in the firewall. If Task Manager shows the CPU or RAM constantly maxed out, the problem is the server rather than the connection, and you need to trim workloads or move to a larger plan.
