In this guide · 8 sections
Short answer
Do not leave Remote Desktop (port 3389) open to the internet. Close the port on your router or cloud firewall, and reach the PC through a VPN with MFA, a Remote Desktop Gateway, or a remote access tool with MFA. Add an account lockout policy and keep Windows patched.
Why exposed RDP gets hacked
RDP listens on TCP port 3389 by default. Automated scanners sweep the internet constantly for that port, and once found, try common usernames and leaked passwords at high speed. A single weak or reused password on an account allowed to sign in remotely is enough.
In a June 2024 joint advisory on Akira ransomware, CSA, SPF and PDPC listed brute-forcing external-facing services such as RDP among the ways attackers gain initial access, alongside VPNs without MFA and stolen credentials. Once inside, they also used RDP to move to other machines on the network.
US agency CISA's #StopRansomware guide gives the same advice: do not expose services such as RDP on the web, and if RDP is necessary, close unused RDP ports, enforce account lockouts, apply MFA and log RDP sign-in attempts.
Where exposed RDP hides in small businesses
- Office router port forward: someone set up "forward port 3389 to the boss's PC" years ago so they could work from home.
- Accounting or POS server: a vendor opened RDP so they could support it remotely, and never closed it.
- Cloud virtual machines: Windows servers on AWS, Azure or other clouds often start with RDP allowed from anywhere. A CSA advisory on cloud security specifically tells organisations to verify that cloud VMs with a public IP do not have open RDP ports.
- Home PCs of staff: less common, but a home router with remote access set up for convenience can expose a work laptop.
How to check whether you have RDP exposed
Check your office router
Log in to the router and look at port forwarding (sometimes called virtual servers or NAT rules). Any rule pointing TCP 3389, or any port, to an internal PC needs a reason and an owner.
Check every cloud firewall
For each cloud VM, open its security group or network firewall rules. An inbound rule allowing 3389 from 0.0.0.0/0 (anyone) is the problem to fix.
Scan your public IP from outside
Use a reputable external port scanner against your office's public IP and each cloud server's IP. Do this only for addresses you own.
Look for signs someone tried
On Windows, check the Security event log for large numbers of failed sign-ins (event ID 4625), and the TerminalServices logs for successful RDP connections you do not recognise.
Ask your vendors
Ask any IT, POS or accounting software vendor how they connect remotely. If the answer is "RDP over the internet", agree a safer method.
Safer ways to keep remote access
Closing the port does not mean losing remote work. Put something with stronger sign-in in front of RDP.
VPN with MFA, then RDP
Common choice- Staff connect to the office or cloud network first
- RDP is only reachable from inside
- The VPN itself must be patched and use MFA
Best for: Offices with several people needing access to internal machines.
Remote Desktop Gateway
- Microsoft's RD Gateway carries RDP over encrypted HTTPS
- Allows remote access without a VPN, per Microsoft's docs
- Needs a Windows Server and careful configuration
Best for: Businesses already running Windows Server.
Remote access tool with MFA
- Agent on the PC connects out to the vendor's service
- No inbound port open on your router
- Choose one with MFA, logging and session alerts
Best for: One or two people reaching a single office PC.
Note that the joint advisory also lists VPNs without MFA as an entry point, so a VPN only helps if it is patched and protected by MFA. Our guide on whether your business needs a VPN covers the choices.
Hardening RDP that must stay on
Even internal RDP should be locked down, because attackers who get in through phishing use it to move between machines.
RDP hardening checklist
Microsoft's account lockout threshold documentation shows the default is 0 invalid sign-in attempts, which means no lockout at all, and that Windows security baselines recommend 10. It also warns that a lockout policy needs a process to unlock accounts, because an attacker can deliberately lock accounts whose names they know.
If you find RDP was exposed
Close the port first, then check for signs of misuse: unknown user accounts, new admin rights, disabled antivirus, unfamiliar remote access software, or large outbound transfers. Change passwords for every account that could sign in over RDP. If you see any of these, treat it as a possible breach and follow our ransomware response guide; attackers often wait days or weeks before encrypting files.
Do it yourself or get help?
Checking a router and a couple of cloud firewalls takes an hour if you have the logins. Setting up a VPN or gateway with MFA is more involved, and a mistake can lock everyone out or leave a new gap.
Our Software & Server Protection Setup (S$590 for one server or app) sets the firewall so only the ports you need are open, adds brute-force protection and automatic security updates, and sends you a daily summary. Our Security Health Check (S$290) gives an external review of your domain, website and email, plus your workspace settings, with a fix list ranked by risk. IT Sorted is a Singapore-based team of developers with over 10 years of experience; you pay upfront, send the brief in writing and follow progress on your order page.
Frequently asked questions
Not directly. RDP exposed on the internet is constantly scanned and attacked with password guessing, and Singapore's CSA, SPF and PDPC have named it as a ransomware entry point. Put RDP behind a VPN with MFA, a Remote Desktop Gateway or a remote access tool with MFA, and close port 3389 to the internet.
No, not meaningfully. Internet scanners check many ports, and an RDP service on a different port is still found and attacked. It may reduce some log noise, but it does not replace closing the port, using a VPN or gateway, MFA and an account lockout policy.
Check your office router's port forwarding rules and every cloud server's firewall for inbound TCP 3389 from any address. Then scan your own public IP addresses with an external port scanner. Large numbers of failed sign-ins in the Windows Security log are another sign it is reachable.
Microsoft's documentation says the default threshold is 0, meaning accounts never lock, and that Windows security baselines recommend locking after 10 invalid sign-in attempts. Pair it with a way to unlock accounts quickly, because attackers can deliberately lock out accounts whose usernames they know.
Only if it is maintained. The same joint advisory lists VPN services without MFA among the ways ransomware groups get in. Use a VPN that is kept on current updates, requires MFA for every user, and logs connections. Then allow RDP only from inside the VPN.