Windows Server Security: RDP, Firewall, Defender, and Updates

1. Establish a recovery and maintenance plan

Verify that your provider console is usable before changing RDP or firewall settings. Take an application-consistent backup and record the server’s role. A domain controller, database server, and standalone web server require different policies; do not apply a generic hardening script to all three.

2. Update the operating system and applications

Review Windows Update or your organization’s update-management system. Install applicable security updates in a maintenance window and complete required restarts. Check application components separately, including IIS extensions, database engines, and third-party agents. Keep a record of the last successful update and reboot.

3. Limit remote administration

Use named administrator accounts with unique passwords, and keep ordinary work separate from administrative sessions. Permit RDP only for people who need it. Prefer a trusted VPN or an appropriately secured Remote Desktop Gateway over exposing RDP broadly to the internet.

Keep Network Level Authentication enabled. NLA requires authentication earlier in the connection process, but it is not multifactor authentication and does not replace network restrictions. See Microsoft’s Remote Desktop guidance.

4. Review the effective firewall policy

In an elevated PowerShell session, inspect the profiles and listening ports before editing rules:

Get-NetFirewallProfile | Select-Object Name, Enabled, DefaultInboundAction, DefaultOutboundAction
Get-NetTCPConnection -State Listen | Sort-Object LocalPort | Select-Object LocalAddress, LocalPort, OwningProcess

Open Windows Defender Firewall with Advanced Security using wf.msc. Find the rules that actually allow your RDP listener, inspect their profiles and remote-address scope, and narrow them to your management network when possible. Review both TCP and UDP rules and any custom listener port.

A new restricted allow rule will not neutralize a different broad allow rule. Review all relevant effective rules, including those delivered by Group Policy. Keep the console open and verify a fresh RDP session from the allowed network before ending the original connection. The Get-NetFirewallProfile reference describes profile inspection.

5. Check endpoint protection

Where Microsoft Defender Antivirus is the active protection product, review its status:

Get-MpComputerStatus | Select-Object AntivirusEnabled, RealTimeProtectionEnabled, AntivirusSignatureLastUpdated

If another managed antivirus product is installed, verify that product’s health and avoid conflicting configurations. Investigate disabled protection rather than creating broad exclusions to silence an alert. See Microsoft’s Defender status reference.

6. Apply a role-appropriate baseline

Microsoft provides security baselines, including OSConfig scenarios for Windows Server 2025. Stage a baseline on a representative test server first: settings can affect authentication, remote management, and application behavior. Use the package intended for your exact release and role, and record approved exceptions. Consult the Windows Server 2025 baseline documentation rather than copying commands intended for another release.

7. Verify operation and recovery

• Test a new remote session through the intended management path.
• Confirm that public web services work while private management and database ports remain restricted.
• Review failed logons and unexpected service changes in Event Viewer.
• Check backup jobs, retention, and an actual restore into an isolated environment.
• Keep recovery credentials and backup copies outside the server they protect.

Avoid changing several authentication and firewall policies at once. Make one reviewed change, test it, and retain a console-based rollback before continuing.