Connecting to a Windows server with Remote Desktop

Why is Remote Desktop Still the Best Option for Managing a Windows Server?

Daily management of a Windows server without direct access to its graphical environment is nearly impossible. The Remote Desktop tool (Remote Desktop Protocol or RDP) is Microsoft's standard protocol for this purpose, allowing you to work with the server as if you were sitting in front of its monitor. Unlike third-party tools like TeamViewer or AnyDesk, RDP is built into Windows Server natively, is lighter, and consumes less bandwidth.

In this article, you will learn how to connect to your Windows server from different operating systems (Windows, Mac, Linux, and mobile), enhance connection security by changing the default port and enabling two-factor authentication, and resolve the most common errors you encounter when connecting. If your server is hosted in the ServerNet datacenter, this guide is written directly for you.

Prerequisites for Connecting to a Windows Server

Before taking any action, make sure these three conditions are met:

• Public IP address or server domain name: If the server is behind NAT, port 3389 must be forwarded on the router to the server's internal IP.
• Valid username and password: Usually the Administrator user or a user who is a member of the Remote Desktop Users group.
• Access to port 3389: If the Windows firewall or the datacenter firewall has blocked this port, the connection will not be established.

To quickly test whether the port is open, run this command from your computer:

Test-NetConnection -ComputerName YOUR_SERVER_IP -Port 3389

The output should be TcpTestSucceeded : True. If it returns False, the issue is with the firewall or routing, not the client settings.

Enabling Remote Desktop on the Server

If you are connecting to the server for the first time (for example, via a web-based console like the datacenter's), first enable RDP:

1. Click on Start, type sysdm.cpl, and press Enter.
2. In the Remote tab, select the option Allow remote connections to this computer.
3. Check Allow connections only from computers running Remote Desktop with Network Level Authentication (this option increases security).
4. Click OK.

You can also use PowerShell:

Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name "fDenyTSConnections" -Value 0
Enable-NetFirewallRule -DisplayGroup "Remote Desktop"

Connecting from Windows 10 and 11

Windows comes with the Remote Desktop Connection client (mstsc) by default. Simply press Win + R and type mstsc.

Important Client Settings

Before clicking Connect, go to the Display tab and set the resolution to Full Screen for a better user experience. In the Local Resources tab, you can transfer local drives, clipboard, and printers to the RDP session. This is very useful for copying files from the server to your local system.

To connect:

1. Enter the IP address or domain name.
2. Click Connect.
3. If a certificate window appears, click Yes (this certificate belongs to the server and it is normal that your client does not recognize it).
4. Enter your username and password.

Common Error: Credentials Don't Work

If you encounter the error Your credentials did not work, make sure you enter the username in the format SERVERNAME\Administrator, not just Administrator. If the server is joined to a domain, use the format DOMAIN\User.

Connecting from macOS

Microsoft has released the official Microsoft Remote Desktop client for Mac, which supports macOS 11 and later. Install it from the App Store.

Connection Steps

1. Open the app, click on +, and select Add PC.
2. In the PC name field, enter the IP address or domain name.
3. In the User account section, click Add User Account and enter the username and password.
4. Click Save, then double-click the PC icon to establish the connection.

To transfer files between Mac and the server, go to Edit in the PC settings, open the Folders tab, and add Mac folders to the session. These folders will appear as network drives on the server.

Connecting from Linux

On Linux, the best open-source tools are Remmina or FreeRDP. To install on Ubuntu/Debian:

sudo apt update
sudo apt install remmina remmina-plugin-rdp

Then open Remmina, select the RDP protocol, enter the IP address, and click Connect. If you prefer the command line, use xfreerdp:

xfreerdp /v:YOUR_SERVER_IP /u:Administrator /dynamic-resolution

This command connects with dynamic resolution, and when you resize the window, the server screen adjusts accordingly.

Connecting from Mobile (Android and iOS)

For emergency server management from your phone, install the official Microsoft Remote Desktop app from Google Play or the App Store. This app is free and supports touch gestures for zooming and scrolling.

On Android, after installation, tap + and select Desktop. Enter the IP address and save the credentials in the User name and Password fields. To connect, tap the desktop icon. If the virtual keyboard doesn't appear, use the arrow button at the top of the screen.

Note: Connecting from mobile is suitable for light tasks like restarting a service or checking logs, but it is not recommended for heavy administrative work because touch precision and typing speed are low.

Securing Remote Desktop: You Must Do These

Port 3389 is one of the most common targets for brute-force attacks on the internet. If your server has a public IP, without security measures, you will see hundreds of failed login attempts daily. Take these actions:

1. Change the Default RDP Port

Changing the port from 3389 to an unusual one significantly reduces automated attacks. To do this, edit the registry:

reg add "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 3390 /f

Then reboot the server. From now on, you must specify the port in the client to connect: YOUR_SERVER_IP:3390.

Warning: If your datacenter firewall does not open the new port, the connection will not be established. In ServerNet, you can add a firewall rule for the new port from the management panel.

2. Restrict Allowed IPs

In the Windows firewall, only allow specific IPs to access the RDP port. Run this command in PowerShell with Administrator access:

Remove-NetFirewallRule -DisplayGroup "Remote Desktop"
New-NetFirewallRule -DisplayName "RDP_Allow_MyIP" -Direction Inbound -Protocol TCP -LocalPort 3390 -RemoteAddress 203.0.113.10 -Action Allow

Replace 203.0.113.10 with your own static IP. If your IP is dynamic, use a DDNS service and configure the rule based on the domain name.

3. Enable Two-Factor Authentication (2FA)

RDP by default only has a password. To add 2FA, you can use the free tool Duo Authentication Proxy, which adds a verification layer via a mobile app. Installing it requires a separate server or the same Windows server and takes about 30 minutes. Definitely do this if your server contains sensitive data.

4. Disable the Default Administrator Account

The Administrator account is always the first target of attacks. Create a new user with an unpredictable name, add it to the Administrators group, and then disable the default account:

net user NewAdmin StrongPass123! /add
net localgroup Administrators NewAdmin /add
net user Administrator /active:no

Troubleshooting Common RDP Connection Errors

In this section, we will examine the three most frequently encountered errors.

Error: "This computer can't connect to the remote computer"

This error usually means the port is closed or the address is wrong. First, test the port with the Test-NetConnection command mentioned at the beginning of the article. If the port is open, make sure the Remote Desktop Services service is running on the server:

Get-Service TermService

If its Status is Stopped, start it:

Start-Service TermService

Error: "The remote session was disconnected because there are no Remote Desktop License Servers available"

This error occurs on Windows servers with multiple simultaneous users. If you only have one or two concurrent users, Microsoft gives you a 120-day trial period. After that, you must purchase an RDS license or limit the number of concurrent sessions to 1. To limit, go to the following path in gpedit.msc:

Computer Configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Connections

Enable the Limit number of connections option and set the value to 1.

Error: "The user account is locked"

After several failed attempts, Windows locks the account. If you are remote and don't have console access, you must log in through the datacenter panel (such as ServerNet's web console) and run this command:

net user Administrator /active:yes

Then check the lockout policy:

net accounts

If the Lockout threshold value is 5, increase it to 10 or more to prevent frequent lockouts.

Optimizing Connection Speed and Stability

If your RDP connection is slow or keeps disconnecting, try these settings:

• In the Windows client, in the Experience tab, select Slow connection (56 kbps) to disable graphical effects.
• On the server, disable visual effects: System Properties > Advanced > Performance Settings and select Adjust for best performance.
• If you use a VPN, make sure your VPN protocol supports UDP (like WireGuard) because RDP over UDP is faster than TCP.
• In the client, enable Persistent bitmap caching so repeated images are cached and less bandwidth is consumed.

Also, if your server is in Iran and you are connecting from abroad, network latency will be high. In this case, using compression tools like RDP Wrapper or switching to the RDP over HTTPS protocol can help, but the simplest solution is to connect through an intermediary server in the same region.

Conclusion

Remote Desktop is a powerful yet vulnerable tool. By following the steps in this article, you can connect to your Windows server from any device and raise its security to an acceptable level. The most important thing to remember is never leave port 3389 open on the internet without IP restrictions and a strong password. If your server is hosted in ServerNet, you can use the cloud firewall in the management panel to restrict access to your own IP and rest assured that brute-force attacks on your server will be ineffective.

If you have a specific error not covered in this article, first check the Windows event logs:

Get-EventLog -LogName "Microsoft-Windows-TerminalServices-LocalSessionManager/Operational" -Newest 10

These logs usually show the exact reason for disconnection or connection failure. With a little searching in these logs, you can root-cause the issue.