RDP VPS on Windows Server: choosing a plan and locking down port 3389

An RDP VPS is a virtual server running Windows Server that you use through Remote Desktop, with its own IP address and a desktop that stays on when your computer is off. Ours run Windows Server 2022 or 2025 with full Administrator access in Ashburn, Virginia, from €12.09 a month, and you bring the Windows licence.

This guide covers what an RDP VPS is for, the four plans and what they cost, how many people can sign in at once, how licensing works, and the settings that keep an RDP server on the public internet out of trouble.

What is an RDP VPS, and who needs one?

A remote desktop VPS is a Windows Server virtual machine on hardware in a data centre. You connect with the Remote Desktop client that ships with Windows, or any RDP client on macOS, Linux, iOS or Android, and you get a full Windows desktop. Close your laptop and the server keeps running, with every program still open when you reconnect.

Businesses use a Windows VPS with remote desktop for a few recurring jobs:

• A shared office desktop. Files, line of business tools and browser sessions live on the server, so a lost laptop loses nothing and a new colleague signs in to a desktop that is already set up.
• Trading terminals that never sleep. MetaTrader terminals, Expert Advisors and other Windows trading software keep running when your own PC is off, from an IP address that does not change when your ISP reconnects.
• Windows only business software. Accounting, ERP and CRM clients that will only ever run on Windows, installed once as Administrator for the whole office.
• A test machine. Installers, browsers under test and a build agent on a clean Windows install you can rebuild from the client panel.

If the software you need runs on Linux, a Linux desktop over xRDP on a KVM VPS is usually cheaper. Our post on remote desktop on Linux, Windows RDP or bare metal draws that line, and the remote desktop use case covers the Linux route in detail.

Which RDP VPS plans are there, and what do they cost?

There are four plans, all on Windows Server 2022 or 2025 with full Administrator access, one dedicated IPv4 address, SSD storage and unmetered traffic. There is no setup fee. Prices are per month unless the column says otherwise, and they exclude VAT.

Plan	vCPU	RAM	SSD	Monthly	Quarterly	Yearly
RDP Starter	2	4 GB	60 GB	€12.09	€36.27	€130.57
RDP Standard	4	8 GB	100 GB	€20.89	€62.67	€225.61
RDP Pro	6	16 GB	160 GB	€32.99	€98.97	€356.29
RDP Business	8	32 GB	240 GB	€93.49	€280.47	€1,009.69

The quarterly price is three times the monthly price. The yearly price is twelve months less 10 percent: RDP Starter paid monthly for a year comes to €145.08, against €130.57 paid yearly.

Two options can be added when you order. Extra IPv4 addresses cost €1.50 a month each, up to ten addresses in total. Extra SSD storage comes in steps of 50 GB for €4 a month, 100 GB for €8 or 150 GB for €12, for when the plan's disk is too small for installers, a local database or user profiles.

How to pick a plan

RAM is what runs out first on a Windows desktop, and the browser is usually what fills it. One person with office apps and a browser fits on RDP Starter. Two people signed in together, or a test box with a couple of browsers and a build agent, suit RDP Standard. Several trading terminals with bots and the occasional backtest, or a business application with its own local SQL database, want the 16 GB on RDP Pro. RDP Business, with 32 GB and 8 vCPU, is sized for a small team sharing one server through Remote Desktop Services.

How many people can use one RDP VPS at the same time?

Two. Windows Server allows two simultaneous Remote Desktop sessions for administration without any extra licensing. That covers one person working while another checks something, or two colleagues on one server.

A third concurrent user needs the Remote Desktop Services Session Host role and an RDS CAL (client access licence) for each user or each device, bought from Microsoft or a reseller. Neither is included in our plan prices. If you plan to run a small team this way, budget for the CALs and choose RDP Pro or RDP Business so every session has memory to work with.

Is a Windows licence included with the RDP VPS?

No. Every plan is bring your own licence. The server installs Microsoft's Windows Server evaluation edition, Standard with Desktop Experience, in version 2022 or 2025. It is the full product and works without restrictions for 180 days.

Before the 180 days are up, convert it with a Windows Server Standard product key you own. From an elevated command prompt:

DISM /online /Set-Edition:ServerStandard /ProductKey:XXXXX-XXXXX-XXXXX-XXXXX-XXXXX /AcceptEula

The conversion needs one restart. If you skip it, Windows reports the licence as expired when the evaluation ends and starts shutting the server down at intervals, which is not something you want to discover during a trading session. Put the date in your calendar on the day the server is delivered.

How do you secure RDP on a VPS?

An RDP port on a public IP address is found by automated scanners soon after it goes online, and they start guessing passwords straight away. As Administrator, every setting below is yours to change. Work through them on day one, in this order.

Keep Network Level Authentication on

NLA makes a client prove its credentials before Windows builds a session, so an anonymous connection never gets as far as a logon screen. It is on by default on Windows Server. Check it under System Properties, Remote, where the box that allows connections only from computers running Remote Desktop with Network Level Authentication should stay ticked.

Use strong passwords and named accounts

Administrator is the first account name every scanner tries. Give it 16 or more random characters from a password manager. Then create a named account for each person, add it to the Administrators group or to Remote Desktop Users, and use those accounts day to day:

net user alice * /add
net localgroup "Remote Desktop Users" alice /add

If you ever lose the Administrator password, you can reset it from the client panel without a ticket.

Set an account lockout policy

A lockout policy turns endless guessing into a few attempts. Open Local Security Policy (secpol.msc), go to Account Policies, Account Lockout Policy, and set a threshold, a lockout duration and a reset window. Ten failed attempts and 15 minutes is a reasonable starting point, and the same can be set from the command line:

net accounts /lockoutthreshold:10 /lockoutduration:15 /lockoutwindow:15

Whether the built in Administrator account itself can be locked out depends on the Windows version and policy, which is one more reason to sign in with named accounts and keep Administrator for emergencies.

Allow port 3389 only from addresses you know

This is the setting that does the most. RDP listens on TCP port 3389 by default. Scope the Remote Desktop firewall rules to your office and home IP addresses, so the rest of the internet cannot reach the logon at all. In Windows Defender Firewall the rule is Remote Desktop - User Mode (TCP-In), and the Scope tab takes a list of remote addresses. In PowerShell, with documentation addresses as placeholders:

Set-NetFirewallRule -DisplayGroup "Remote Desktop" -RemoteAddress 203.0.113.10,198.51.100.0/24

If your team works from changing addresses, put the server behind a VPN you already run and allow RDP only from the VPN's address. Add your own address before you save the rule, or you will lock yourself out. A reinstall from the client panel is the last resort, and it wipes the server.

Change the RDP port, as an extra

Moving RDP off 3389 cuts the noise from automated scans in your logs. It does not protect the server by itself, because a scanner that tries every port still finds it, so do it on top of the steps above. Open the new port first, then change the port and restart the service:

New-NetFirewallRule -DisplayName "RDP 50123" -Direction Inbound -Protocol TCP -LocalPort 50123 -RemoteAddress 203.0.113.10 -Action Allow
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" -Name PortNumber -Value 50123
Restart-Service TermService -Force

Then connect to the server's address followed by a colon and the new port number.

Leave Windows Update on and watch failed logons

Fixes for Remote Desktop vulnerabilities arrive through Windows Update. Set active hours so restarts land outside your working or trading hours rather than switching updates off. Failed sign in attempts are logged as event 4625 in the Security log, and a quick look shows whether your scoping is working:

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625} -MaxEvents 20

Where are the servers, and does location matter?

Our RDP VPS plans run in Ashburn, Virginia, on the US East Coast, and in no other location. The server and its data are in the United States, which matters if a contract or a regulator says where your data may live.

For trading, what counts is the route from the server to your broker's servers, not the distance on a map. Check that route in our Looking Glass before you move a latency sensitive strategy, and read our guide to where to run a trading bot if your broker is in Europe. Bots that run on Linux, including MetaTrader under Wine, are covered on our trading bot use case.

If Windows has to run in Europe

Windows Server 2022 and 2025 are also install options on our dedicated servers, which can be ordered in 11 countries across Europe and the US. The entry machine is a Dual Xeon E5 2630 v3 with 16 cores and 128 GB for €209 a month, and our Xeon E5 2630 v3 guide explains what it suits. A whole server is the right step when a team outgrows RDP Business, or when the data must stay in the EU.

Questions people ask

Do I get a fixed IP address with an RDP VPS?

Yes. Every plan includes one dedicated IPv4 address assigned to your server alone, so a broker allowlist, a firewall rule or a licence server sees the same address every day. More IPv4 addresses cost €1.50 a month each when you order.

Can I install any software on a Windows VPS with RDP?

Yes, within our acceptable use policy. You have the full Administrator account, so you can install applications, change services and configure the firewall as you would on any Windows Server. Software licences, including Windows itself, are yours to bring.

Is the RDP connection encrypted?

Yes. Modern RDP clients and Windows Server negotiate TLS for the session, and with NLA the credentials are checked before a desktop is created. Encryption does not stop password guessing, which is why the firewall scope and the lockout policy matter more.

Is there a limit on traffic?

No. Traffic on every RDP plan is unmetered, so there is no transfer allowance to watch and no overage line on the invoice.

Choosing your RDP VPS server

The Windows RDP plans page lists all four plans with the order links and a short guide to which plan fits which job. Pick the plan by RAM and concurrent users, convert the evaluation with your own key, and scope port 3389 before you do anything else on the server.