# Is RDP safe over the internet? What NCSC says

> Is Remote Desktop safe to expose to the internet? What the NCSC and Cyber Essentials say, and safer ways in: allow lists, RD Gateway with MFA, or a VPN.

Source: https://wharfcloud.co.uk/guides/is-remote-desktop-safe-over-the-internet · Last updated 21 October 2026 · WharfCloud

Published 21 October 2026. Reading time about 7 minutes.

## Short answer

Not when Remote Desktop (RDP) is open to the whole internet. The NCSC says ransomware is increasingly deployed by attackers who got in through exposed services such as RDP, and advises disabling RDP where it is not needed, putting multi-factor authentication (MFA) on every remote access point, enforcing IP allow lists and using a VPN for remote access. Cyber Essentials adds firm rules: unauthenticated inbound connections blocked by default, every inbound firewall rule documented with a business need, and protection against password guessing. RDP itself is fine to use behind one of those controls, with Network Level Authentication on and the server patched.

## What the NCSC says about exposed RDP

The NCSC's guidance on mitigating malware and ransomware names Remote Desktop Protocol as one of the exposed services attackers use to get in. To prevent it, the NCSC says organisations should:

- **Disable RDP if it is not needed.** If you are not sure whether you run it, the NCSC suggests registering for its free Early Warning service.
- **Enable MFA at all remote access points** into the network, and enforce IP allow listing using hardware firewalls.
- **Use a VPN** that meets the NCSC's recommendations for remote access to services.
- **Use least privilege:** sign in with low-privilege accounts, with an audited way to step up inside the session when needed.
- **Patch remote access and external-facing devices immediately** when vendors release fixes.

An NCSC blog on interactive administration in the cloud (April 2024) makes the same point for servers in data centres: management protocols like RDP and SSH are often exposed straight to the internet there, attackers routinely target exposed management interfaces, and the NCSC has long recommended protecting them from untrusted networks.

## What Cyber Essentials requires

Cyber Essentials does not ban RDP, but several requirements in version 3.3 (April 2026) apply directly to a server you reach with it:

Table: Cyber Essentials v3.3 requirements that apply to Remote Desktop

| Control | Requirement | What it means for RDP |
| --- | --- | --- |
| Firewalls | Block unauthenticated inbound connections by default. Inbound rules must be approved and documented by an authorised person, with the business need, and removed when no longer needed. | An open RDP rule needs a written reason and an owner. "Anyone, anywhere" is hard to justify. |
| User access control | Use MFA where available; the NCSC says you should always use it for administrative accounts and accounts accessible from the internet. Authentication to cloud services must always use MFA. | If a login is reachable from the internet, plan for MFA on it, for example at a gateway. |
| User access control | Use separate accounts for administrative work only. | Do not run day-to-day work as the server administrator over RDP. |
| Password-based authentication | Protect passwords against guessing with at least one of: MFA, throttling to no more than 10 guesses in 5 minutes, or locking after no more than 10 failed attempts. | An internet-facing RDP login with none of MFA, throttling or lockout fails this. |
| Security update management | Software on in-scope devices must be licensed and supported, with critical and high-risk updates applied within 14 days. | A Windows Server 2016 RDP host loses free security updates on 12 January 2027. |

Whether a particular set-up passes is decided by your certification body, so describe your remote access honestly in the assessment. More on the unsupported software rule in our [Cyber Essentials guide](https://wharfcloud.co.uk/guides/cyber-essentials-unsupported-software).

## Safer ways to reach a Remote Desktop server

Table: Ways to put a control in front of RDP

| Approach | How it works | Good for | Watch out for |
| --- | --- | --- | --- |
| IP allow list | The firewall only lets known addresses, such as your office, reach the server. | Teams that work from one or two fixed sites. | Home broadband addresses can change, so remote staff may be locked out. |
| Remote Desktop Gateway | Microsoft's RD Gateway role carries Remote Desktop inside an encrypted HTTPS connection (TCP port 443), so users connect over the internet without a VPN. It can use RADIUS to add MFA, for example Microsoft Entra multifactor authentication through the NPS extension. | People who connect from anywhere. | The gateway is now the internet-facing part: keep it patched and its certificate valid. |
| VPN | Users join the private network first, then use RDP inside it. | Firms that already run a VPN that meets NCSC advice. | The VPN device itself must be patched quickly; the NCSC lists unpatched remote access devices as an entry point too. |
| Port 3389 open to everyone | Microsoft's default RDP listening port, reachable by any address. | Nothing. | This is the exposed service the NCSC warns about. |

Microsoft documents how to change the RDP listening port from its default of 3389. A different port may cut down automated noise, but it is not one of the controls the NCSC or Cyber Essentials list, so do not count it as one.

## Settings to check on the server itself

1. **Network Level Authentication on.** Microsoft says that with NLA users must authenticate before a remote session is established, and recommends keeping it enabled for most environments.
2. **Lockout or throttling.** Make sure repeated wrong passwords lock the account or slow attempts down, within the Cyber Essentials limits of 10.
3. **Separate admin accounts.** Staff sign in with standard accounts; administrator accounts are used only for administration.
4. **Patches on time.** Windows and anything else reachable from outside, such as a gateway or VPN device, updated promptly; and the Windows release still in support.
5. **Review the rule.** Write down who needs RDP and why. Remove access for leavers and close rules that are no longer needed.

## How our hosted servers handle it

On our [Managed Windows Server](https://wharfcloud.co.uk/managed-servers/windows), every Remote Desktop sign-in needs a password and a code from an authenticator app, for your team and for our engineers, and we can also limit access to your office IP addresses. Critical and high-risk Windows updates go on within 14 days of release. Both are written into section 12 of our [terms](https://wharfcloud.co.uk/legal/terms#security). That is how we host [Sage 50](https://wharfcloud.co.uk/hosted-business-software/sage-50), [Microsoft Access](https://wharfcloud.co.uk/hosted-business-software/microsoft-access) and the other [business software](https://wharfcloud.co.uk/hosted-business-software) we run.

Still running an office server on Windows Server 2016 that people reach over RDP? Our [Windows Server 2016 migration plan](https://wharfcloud.co.uk/windows-server-2016-end-of-support) maps what runs on it and where it should go before 12 January 2027.

## Frequently asked questions

### Is RDP secure without a VPN?

It can be, if something other than a password stands in front of it. Microsoft's Remote Desktop Gateway lets users connect over the internet without a VPN, inside an encrypted HTTPS connection, and can add MFA. An IP allow list is another option. RDP open to every address on the internet is not safe, according to the NCSC.

### Should port 3389 be open to the internet?

No. 3389 is Microsoft's default RDP port. The NCSC names exposed RDP as a route for ransomware and advises MFA at every remote access point and IP allow listing.

### Does changing the RDP port make it safe?

No. Microsoft documents how to change the port, but it is not one of the controls the NCSC or Cyber Essentials ask for. Use an allow list, a gateway with MFA or a VPN instead.

### Does Cyber Essentials allow Remote Desktop?

Yes, it does not ban it. But the firewall, MFA and password-guessing requirements in version 3.3 all apply, and the server must run supported, patched software. Your certification body decides whether your set-up meets them.

### What is Network Level Authentication?

A Remote Desktop setting that makes users authenticate before a remote session is established. Microsoft recommends keeping it on for most environments.

### How do I find out if our RDP is exposed?

Check your firewall rules for anything that forwards port 3389 or another RDP port from the internet. If you are not sure whether you run RDP at all, the NCSC suggests registering for its free Early Warning service.

## Sources

- [NCSC: Mitigating malware and ransomware attacks](https://www.ncsc.gov.uk/guidance/mitigating-malware-and-ransomware-attacks)
- [NCSC: Interactive administration in the cloud, managing the risks (10 April 2024), PDF](https://www.ncsc.gov.uk/sites/default/files/2026-07/Interactive-administration-in-the-cloud-managing-the-risks.pdf)
- [NCSC: Cyber Essentials Requirements for IT Infrastructure v3.3 (April 2026), PDF](https://www.ncsc.gov.uk/files/cyber-essentials-requirements-for-it-infrastructure-v3-3.pdf)
- [NCSC: Early Warning service](https://www.ncsc.gov.uk/information/early-warning-service)
- [Microsoft Learn: Change the listening port for Remote Desktop](https://learn.microsoft.com/en-us/windows-server/remote/remote-desktop-services/remotepc/change-listening-port)
- [Microsoft Learn: Allow access to your PC with Remote Desktop (Network Level Authentication)](https://learn.microsoft.com/en-us/windows-server/remote/remote-desktop-services/remotepc/remote-desktop-allow-access)
- [Microsoft Learn: Deploy the Remote Desktop Gateway role](https://learn.microsoft.com/en-us/windows-server/remote/remote-desktop-services/remote-desktop-gateway-role)
- [Microsoft Learn: Remote Desktop Services roles](https://learn.microsoft.com/en-us/windows-server/remote/remote-desktop-services/rds-roles)
- [Microsoft Learn: Access Remote Desktop from anywhere](https://learn.microsoft.com/en-us/windows-server/remote/remote-desktop-services/rds-plan-access-from-anywhere)
- [Microsoft Learn: Integrate RD Gateway with Microsoft Entra multifactor authentication (NPS extension)](https://learn.microsoft.com/en-us/entra/identity/authentication/howto-mfa-nps-extension-rdg)
- [Microsoft Lifecycle: Windows Server 2016](https://learn.microsoft.com/en-us/lifecycle/products/windows-server-2016)

---

WharfCloud is a trading name of Sunucu Internet Services Consultancy Ltd, registered in England and Wales, company number 12963678. Not VAT registered.
Support: engineers Monday to Friday, 08:00 to 18:00 UK time. Critical incidents: A person responds to critical incidents within 1 hour (Every day, 07:00 to 23:00 UK time). Automated monitoring and automated recovery overnight and at weekends.
Contact: hello@wharfcloud.co.uk · https://wharfcloud.co.uk/contact