Guide
Is RDP safe over the internet? What NCSC says
Published · 7 min read
Short answer
Not when Remote Desktop (RDP) is open to the whole internet. The NCSC says ransomware is increasingly deployed by attackers who got in through exposed services such as RDP, and advises disabling RDP where it is not needed, putting multi-factor authentication (MFA) on every remote access point, enforcing IP allow lists and using a VPN for remote access. Cyber Essentials adds firm rules: unauthenticated inbound connections blocked by default, every inbound firewall rule documented with a business need, and protection against password guessing. RDP itself is fine to use behind one of those controls, with Network Level Authentication on and the server patched.
What the NCSC says about exposed RDP
The NCSC's guidance on mitigating malware and ransomware names Remote Desktop Protocol as one of the exposed services attackers use to get in. To prevent it, the NCSC says organisations should:
- Disable RDP if it is not needed. If you are not sure whether you run it, the NCSC suggests registering for its free Early Warning service.
- Enable MFA at all remote access points into the network, and enforce IP allow listing using hardware firewalls.
- Use a VPN that meets the NCSC's recommendations for remote access to services.
- Use least privilege: sign in with low-privilege accounts, with an audited way to step up inside the session when needed.
- Patch remote access and external-facing devices immediately when vendors release fixes.
An NCSC blog on interactive administration in the cloud (April 2024) makes the same point for servers in data centres: management protocols like RDP and SSH are often exposed straight to the internet there, attackers routinely target exposed management interfaces, and the NCSC has long recommended protecting them from untrusted networks.
What Cyber Essentials requires
Cyber Essentials does not ban RDP, but several requirements in version 3.3 (April 2026) apply directly to a server you reach with it:
| Control | Requirement | What it means for RDP |
|---|---|---|
| Firewalls | Block unauthenticated inbound connections by default. Inbound rules must be approved and documented by an authorised person, with the business need, and removed when no longer needed. | An open RDP rule needs a written reason and an owner. "Anyone, anywhere" is hard to justify. |
| User access control | Use MFA where available; the NCSC says you should always use it for administrative accounts and accounts accessible from the internet. Authentication to cloud services must always use MFA. | If a login is reachable from the internet, plan for MFA on it, for example at a gateway. |
| User access control | Use separate accounts for administrative work only. | Do not run day-to-day work as the server administrator over RDP. |
| Password-based authentication | Protect passwords against guessing with at least one of: MFA, throttling to no more than 10 guesses in 5 minutes, or locking after no more than 10 failed attempts. | An internet-facing RDP login with none of MFA, throttling or lockout fails this. |
| Security update management | Software on in-scope devices must be licensed and supported, with critical and high-risk updates applied within 14 days. | A Windows Server 2016 RDP host loses free security updates on 12 January 2027. |
Whether a particular set-up passes is decided by your certification body, so describe your remote access honestly in the assessment. More on the unsupported software rule in our Cyber Essentials guide.
Safer ways to reach a Remote Desktop server
| Approach | How it works | Good for | Watch out for |
|---|---|---|---|
| IP allow list | The firewall only lets known addresses, such as your office, reach the server. | Teams that work from one or two fixed sites. | Home broadband addresses can change, so remote staff may be locked out. |
| Remote Desktop Gateway | Microsoft's RD Gateway role carries Remote Desktop inside an encrypted HTTPS connection (TCP port 443), so users connect over the internet without a VPN. It can use RADIUS to add MFA, for example Microsoft Entra multifactor authentication through the NPS extension. | People who connect from anywhere. | The gateway is now the internet-facing part: keep it patched and its certificate valid. |
| VPN | Users join the private network first, then use RDP inside it. | Firms that already run a VPN that meets NCSC advice. | The VPN device itself must be patched quickly; the NCSC lists unpatched remote access devices as an entry point too. |
| Port 3389 open to everyone | Microsoft's default RDP listening port, reachable by any address. | Nothing. | This is the exposed service the NCSC warns about. |
Microsoft documents how to change the RDP listening port from its default of 3389. A different port may cut down automated noise, but it is not one of the controls the NCSC or Cyber Essentials list, so do not count it as one.
Settings to check on the server itself
- 01
Network Level Authentication on
Microsoft says that with NLA users must authenticate before a remote session is established, and recommends keeping it enabled for most environments.
- 02
Lockout or throttling
Make sure repeated wrong passwords lock the account or slow attempts down, within the Cyber Essentials limits of 10.
- 03
Separate admin accounts
Staff sign in with standard accounts; administrator accounts are used only for administration.
- 04
Patches on time
Windows and anything else reachable from outside, such as a gateway or VPN device, updated promptly; and the Windows release still in support.
- 05
Review the rule
Write down who needs RDP and why. Remove access for leavers and close rules that are no longer needed.
How our hosted servers handle it
On our Managed Windows Server, every Remote Desktop sign-in needs a password and a code from an authenticator app, for your team and for our engineers, and we can also limit access to your office IP addresses. Critical and high-risk Windows updates go on within 14 days of release. Both are written into section 12 of our terms. That is how we host Sage 50, Microsoft Access and the other business software we run.
Still running an office server on Windows Server 2016 that people reach over RDP? Our Windows Server 2016 migration plan maps what runs on it and where it should go before 12 January 2027.
Sources
- NCSC: Mitigating malware and ransomware attacks (opens in a new tab)
- NCSC: Interactive administration in the cloud, managing the risks (10 April 2024), PDF (opens in a new tab)
- NCSC: Cyber Essentials Requirements for IT Infrastructure v3.3 (April 2026), PDF (opens in a new tab)
- NCSC: Early Warning service (opens in a new tab)
- Microsoft Learn: Change the listening port for Remote Desktop (opens in a new tab)
- Microsoft Learn: Allow access to your PC with Remote Desktop (Network Level Authentication) (opens in a new tab)
- Microsoft Learn: Deploy the Remote Desktop Gateway role (opens in a new tab)
- Microsoft Learn: Remote Desktop Services roles (opens in a new tab)
- Microsoft Learn: Access Remote Desktop from anywhere (opens in a new tab)
- Microsoft Learn: Integrate RD Gateway with Microsoft Entra multifactor authentication (NPS extension) (opens in a new tab)
- Microsoft Lifecycle: Windows Server 2016 (opens in a new tab)
Facts were checked against these sources on 21 October 2026. Vendor terms change; check the source before relying on a detail.