Confirm that the provider console or another approved management route works before changing RDP settings. Keep the current session open until a second connection succeeds. Record the server hostname, actual management port and the source addresses that need access.

1. Review the accounts permitted to sign in. Use named accounts with strong, unique credentials and remove obsolete access. Grant administrative rights only where the work needs them.
2. On a Desktop Experience installation, open the Remote Desktop settings and enable the service for the intended users. On Server Core, run SConfig, choose 7 for Remote desktop, and enable the option requiring Network Level Authentication.
3. Keep Network Level Authentication enabled. It requires authentication before the desktop session is established; it does not replace the network access policy.
4. Prefer an approved private management path, such as a VPN or managed gateway, when available. Apply its own authentication and access requirements.
5. Open wf.msc and inspect the relevant Remote Desktop inbound rules. Restrict their remote-address scope to the approved management sources and apply the correct network profiles.
6. Review the provider or perimeter firewall separately. Its allowed sources and destination port must agree with the Windows configuration.
7. From an approved source, establish a fresh session with the intended user. Also confirm that a source outside the permitted scope cannot reach the management service.

Document how authorised staff update the allowlist when their management address changes. Check certificates and connection warnings through a trusted channel rather than accepting an unexpected server identity automatically. Apply Windows and client updates through the normal maintenance process.

• Diagnosing a Windows Server RDP connection failure
• Creating a narrowly scoped Windows Firewall rule
• Applying Windows Server updates with a maintenance plan
• Verify account authority before changing hosting access
• Installing cPanel and WHM on a new self-managed server

• Microsoft: enable Remote Desktop
• Microsoft: configure Windows Server with SConfig
• Microsoft: configure Windows Firewall rules
• Microsoft: Windows Firewall overview