{"id":711,"date":"2026-09-23T11:41:25","date_gmt":"2026-09-23T11:41:25","guid":{"rendered":"https:\/\/kb.powervps.net\/?p=711"},"modified":"2026-09-23T11:41:25","modified_gmt":"2026-09-23T11:41:25","slug":"rdp-connects-only-on-the-fifth-try-how-we-found-the-culprit-and-secured-the-server-against-hacking-in-15-minutes","status":"publish","type":"post","link":"https:\/\/kb.powervps.net\/?p=711","title":{"rendered":"RDP connects only on the fifth try: how we found the culprit and secured the server against hacking in 15 minutes."},"content":{"rendered":"<h1 style=\"text-align: center;\">RDP Connects Only After Several Attempts: How to Diagnose and Secure Your Windows Server<\/h1>\n<p>If your Windows server accepts an RDP connection only after several attempts, or an active session frequently disconnects and reconnects, the problem may not be your Internet connection or the server itself.<\/p>\n<p>One possible cause is a large number of automated login attempts against publicly accessible RDP and SSH ports.<\/p>\n<p>In this example, a Windows VPS received more than <strong>3,000 failed RDP login attempts in three days<\/strong>. Restricting access by IP address and moving RDP away from the default port resolved the connection problems.<\/p>\n<h2>Symptoms<\/h2>\n<p>The Windows VPS was running continuously with browser automation, scripts, and other services.<\/p>\n<p>However, remote access became unstable:<\/p>\n<ul>\n<li>RDP connections succeeded only after 2\u20135 attempts.<\/li>\n<li>Active RDP sessions occasionally disconnected and immediately reconnected.<\/li>\n<li>SSH connections used by scripts also started failing with errors such as <code>Connection reset by peer<\/code> and <code>Connection closed<\/code>.<\/li>\n<\/ul>\n<p>At the same time, the server itself appeared healthy:<\/p>\n<ul>\n<li>CPU usage was normal.<\/li>\n<li>Memory usage was normal.<\/li>\n<li>There was no packet loss.<\/li>\n<li>Network latency was stable.<\/li>\n<\/ul>\n<h2>Step 1. Check RDP Connection Logs<\/h2>\n<p>Windows includes built-in event logs that can help identify incoming Remote Desktop connections.<\/p>\n<p>Open <strong>PowerShell as Administrator<\/strong> and run:<\/p>\n<pre><code class=\"language-powershell\"># Show RDP connections from the last 3 days\r\nGet-WinEvent -FilterHashtable @{\r\n    LogName   = 'Microsoft-Windows-RemoteDesktopServices-RdpCoreTS\/Operational'\r\n    Id        = 131\r\n    StartTime = (Get-Date).AddDays(-3)\r\n} | Select-Object TimeCreated, Message -First 50<\/code><\/pre>\n<p>Event ID <strong>131<\/strong> shows when the RDP service accepts a new TCP connection from a client.<\/p>\n<p>You can also check the number of failed Windows logins using Security event ID <strong>4625<\/strong>:<\/p>\n<pre><code class=\"language-powershell\">(Get-WinEvent -FilterHashtable @{\r\n    LogName   = 'Security'\r\n    Id        = 4625\r\n    StartTime = (Get-Date).AddDays(-3)\r\n}).Count<\/code><\/pre>\n<h2>What We Found<\/h2>\n<p>In this case, the logs showed:<\/p>\n<ul>\n<li><strong>3,231 failed RDP login attempts in three days.<\/strong><\/li>\n<li><strong>1,605 failed SSH login attempts in one day.<\/strong><\/li>\n<li>New connection attempts arriving every few seconds from many different IP addresses.<\/li>\n<li>Repeated connect, disconnect, and reconnect events for the legitimate RDP user.<\/li>\n<\/ul>\n<p>The RDP and SSH services were continuously processing unwanted connection attempts while the legitimate user was trying to connect.<\/p>\n<h2>Why This Happened<\/h2>\n<p>The server was expected to be protected by the provider-side network filter.<\/p>\n<p>However, testing showed that the standard ports were still accessible from the Internet:<\/p>\n<ul>\n<li><strong>RDP:<\/strong> TCP\/UDP port 3389<\/li>\n<li><strong>SSH:<\/strong> TCP port 22<\/li>\n<\/ul>\n<p>The default Windows Firewall rules for Remote Desktop and OpenSSH also allowed connections from any remote address.<\/p>\n<p><strong>Important:<\/strong> Do not assume that a port is inaccessible simply because a network filter is configured in a provider control panel. Always verify access from an external network.<\/p>\n<h2>Step 2. Restrict RDP and SSH by IP Address<\/h2>\n<p>The most effective protection in this scenario is to allow RDP and SSH only from trusted IP addresses.<\/p>\n<p>For example:<\/p>\n<ul>\n<li>Your home IP address<\/li>\n<li>Your office IP address<\/li>\n<li>Another trusted server<\/li>\n<li>Your VPN subnet<\/li>\n<\/ul>\n<p>Open <strong>PowerShell as Administrator<\/strong>.<\/p>\n<p>Define the addresses that should be allowed:<\/p>\n<pre><code class=\"language-powershell\">$allowed = @(\r\n    '203.0.113.10',\r\n    '198.51.100.20',\r\n    '10.10.10.0\/24'\r\n)<\/code><\/pre>\n<p>Replace these example addresses with your actual trusted IP addresses.<\/p>\n<p>Then apply the whitelist to the RDP and OpenSSH firewall rules:<\/p>\n<pre><code class=\"language-powershell\">foreach ($rule in 'RemoteDesktop-UserMode-In-TCP',\r\n                         'RemoteDesktop-UserMode-In-UDP',\r\n                         'OpenSSH-Server-In-TCP',\r\n                         'sshd') {\r\n\r\n    Set-NetFirewallRule `\r\n        -Name $rule `\r\n        -RemoteAddress $allowed `\r\n        -ErrorAction SilentlyContinue\r\n}<\/code><\/pre>\n<p>Windows Firewall should normally be configured to block unsolicited inbound connections by default.<\/p>\n<p>With this configuration, connections from addresses that are not included in the whitelist will be blocked before they reach the RDP or SSH service.<\/p>\n<h2>Step 3. Change the Default RDP Port<\/h2>\n<p>The IP whitelist provides the primary access restriction.<\/p>\n<p>You can also move RDP away from the default port <strong>3389<\/strong> to reduce unwanted connection attempts from automated scanners.<\/p>\n<p><strong>Important:<\/strong> Make sure the new port is allowed in Windows Firewall before restarting the Remote Desktop service. Incorrect firewall configuration may prevent you from reconnecting to the server.<\/p>\n<p>First, choose an available port.<\/p>\n<p>For example:<\/p>\n<pre><code class=\"language-powershell\">$port = 50000<\/code><\/pre>\n<p>You can replace <code>50000<\/code> with another available TCP\/UDP port.<\/p>\n<p>Change the RDP port in the Windows Registry:<\/p>\n<pre><code class=\"language-powershell\">Set-ItemProperty `\r\n    'HKLM:\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server\\WinStations\\RDP-Tcp' `\r\n    -Name PortNumber `\r\n    -Value $port<\/code><\/pre>\n<p>Create firewall rules for the new port:<\/p>\n<pre><code class=\"language-powershell\">New-NetFirewallRule `\r\n    -Name \"RDP-$port-TCP\" `\r\n    -DisplayName \"RDP $port (whitelist)\" `\r\n    -Direction Inbound `\r\n    -Protocol TCP `\r\n    -LocalPort $port `\r\n    -RemoteAddress $allowed `\r\n    -Action Allow\r\n\r\nNew-NetFirewallRule `\r\n    -Name \"RDP-$port-UDP\" `\r\n    -DisplayName \"RDP $port UDP (whitelist)\" `\r\n    -Direction Inbound `\r\n    -Protocol UDP `\r\n    -LocalPort $port `\r\n    -RemoteAddress $allowed `\r\n    -Action Allow<\/code><\/pre>\n<p>Restart the Remote Desktop Services service:<\/p>\n<pre><code class=\"language-powershell\">Restart-Service TermService -Force<\/code><\/pre>\n<p><strong>Important:<\/strong> Your current RDP connection will be disconnected when the service restarts.<\/p>\n<p>After changing the port, connect using:<\/p>\n<pre><code>SERVER_IP:PORT<\/code><\/pre>\n<p>For example:<\/p>\n<pre><code>203.0.113.100:50000<\/code><\/pre>\n<h2>Step 4. Configure a Backup Access Method<\/h2>\n<p>If you restrict RDP access to your home or office IP address, remember that your public IP may change.<\/p>\n<p>If that happens, the whitelist may prevent you from connecting.<\/p>\n<p>For this reason, it is recommended to prepare an alternative access method before applying strict firewall rules.<\/p>\n<p>For example:<\/p>\n<ul>\n<li>A VPN connection such as WireGuard<\/li>\n<li>Another trusted server with a static IP address<\/li>\n<li>Provider VNC or recovery console access<\/li>\n<\/ul>\n<p>The backup access method should use an IP address or network that is already included in the whitelist.<\/p>\n<h2>Step 5. Verify the Result<\/h2>\n<p>After applying the changes, check the configuration from both an allowed and an unauthorized network.<\/p>\n<p>Verify that:<\/p>\n<ul>\n<li>RDP works from your trusted IP address.<\/li>\n<li>The new RDP port is accessible.<\/li>\n<li>The old port 3389 is no longer publicly accessible if it is no longer required.<\/li>\n<li>Connections from unauthorized IP addresses are blocked.<\/li>\n<li>The RDP event log no longer contains continuous unwanted connection attempts.<\/li>\n<li>SSH connections remain stable.<\/li>\n<\/ul>\n<p>In the example described here, after applying the restrictions:<\/p>\n<ul>\n<li>The server accepted the legitimate RDP connection on the first attempt.<\/li>\n<li>RDP sessions stopped disconnecting unexpectedly.<\/li>\n<li>SSH sessions became stable.<\/li>\n<li>Unwanted connection attempts stopped reaching the services.<\/li>\n<\/ul>\n<h2>Additional Security Recommendations<\/h2>\n<p>You can further improve server security with the following measures:<\/p>\n<ul>\n<li><strong>Use SSH keys instead of passwords.<\/strong> If possible, disable password authentication for SSH.<\/li>\n<li><strong>Use a strong Administrator password.<\/strong> An IP whitelist should not replace strong authentication.<\/li>\n<li><strong>Keep a recovery access method available.<\/strong> VNC or another provider console can help if Windows Firewall blocks your normal connection.<\/li>\n<li><strong>Monitor failed login attempts.<\/strong> Periodically review Windows Security and Remote Desktop event logs for unusual activity.<\/li>\n<\/ul>\n<h2>Conclusion<\/h2>\n<p>If RDP connects only after several attempts or frequently disconnects, check whether the server is receiving a large number of unwanted connection attempts.<\/p>\n<p>In this case, the problem was caused by RDP and SSH being accessible from the public Internet while automated systems continuously attempted to connect.<\/p>\n<p>Restricting RDP and SSH to trusted IP addresses and moving RDP away from the default port eliminated the unwanted traffic and restored stable remote access.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>RDP Connects Only After Several Attempts: How to Diagnose and Secure Your Windows Server If your Windows server accepts an RDP connection only after several attempts, or an active session frequently disconnects and reconnects, the problem may not be your Internet connection or the server itself. One possible cause is a large number of automated [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-711","post","type-post","status-publish","format-standard","hentry","category-dedicated-servers"],"_links":{"self":[{"href":"https:\/\/kb.powervps.net\/index.php?rest_route=\/wp\/v2\/posts\/711","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/kb.powervps.net\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/kb.powervps.net\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/kb.powervps.net\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/kb.powervps.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=711"}],"version-history":[{"count":1,"href":"https:\/\/kb.powervps.net\/index.php?rest_route=\/wp\/v2\/posts\/711\/revisions"}],"predecessor-version":[{"id":712,"href":"https:\/\/kb.powervps.net\/index.php?rest_route=\/wp\/v2\/posts\/711\/revisions\/712"}],"wp:attachment":[{"href":"https:\/\/kb.powervps.net\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=711"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/kb.powervps.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=711"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/kb.powervps.net\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=711"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}