In this guide
Short answer: Remote Desktop is safe only when it is not exposed to the internet. Never forward the Remote Desktop port from your router. Put a VPN in front of it, use strong unique passwords and two-step verification, and keep Windows updated. Then your PC is reachable only to people who have already passed a secure, encrypted door.
Being able to sit at your office PC from your kitchen table, or fix a family member’s computer from a distance, is brilliant. But Remote Desktop has a bad reputation, and for good reason: leaving it open to the internet is one of the oldest ways in for criminals, and a common route for ransomware.
Why exposed remote desktop is dangerous
Remote Desktop normally listens on port 3389. Automated tools scan the whole internet for open ports every day, and an exposed one is found within minutes. Attackers then guess passwords relentlessly, use stolen credentials from earlier breaches, or exploit weaknesses. The UK’s National Cyber Security Centre advises against exposing remote access services directly to the internet and recommends using a VPN and multi-factor authentication.
Windows Home or Pro?
A common surprise: PCs running Windows Home can connect to other computers with Remote Desktop, but cannot host connections. To use the built-in feature to reach a PC, it needs to be running Windows Pro or a business edition. Home users usually turn to a different remote access tool instead.
Three ways to do it safely
1. Remote Desktop behind a home VPN (best for control)
Set up a VPN on your router or NAS. When you are away, connect to the VPN first, then open Remote Desktop to the PC’s home address. Nothing is open to the internet except the VPN. See home VPN versus a VPN subscription app for how that works.
2. A reputable remote access tool
Services such as Chrome Remote Desktop and similar tools connect outwards, so you do not forward any ports. They are convenient, but your access depends on their service and your account security, so use a long unique password and two-step verification.
3. Business-grade gateways
Larger setups use a Remote Desktop Gateway or a zero-trust service with identity checks. This is overkill for most homes, but worth considering for small businesses with several staff.
Hardening checklist
- Never forward port 3389, or any remote access port, directly from the router.
- Keep Network Level Authentication switched on.
- Use long, unique passwords, with two-step verification wherever it is available.
- Limit which accounts may connect, and do not use an administrator account for everyday remote access.
- Turn on account lockout, so repeated wrong guesses block the account.
- Keep Windows and the router firmware fully updated.
- Do not rely on changing the port number, as it does not stop determined attackers.
Wake your PC when you need it
You do not have to leave a PC running all day. Wake-on-LAN can start a sleeping PC when you connect to your home VPN, which saves power and shrinks the time it is exposed.
Check what is already open
Many people have forgotten that they once opened a port for a camera, a game or a PC. A quick review of your router’s port forwarding and UPnP settings often finds old openings that should be closed. For the broader picture, read our guide to accessing your home network remotely without getting hacked, and see how to reach a NAS without opening ports.
HomeIT Services sets up secure remote access, firewalls and VPNs for homes and small businesses across Essex. Take a look at VPN and secure remote access setup, or contact us from Billericay, Brentwood or nearby.
Frequently asked questions
No. Remote Desktop exposed directly to the internet is a common target for automated attacks. Keep it behind a VPN instead.
Windows Home can connect to other PCs but cannot be the PC you connect to. Hosting needs Windows Pro or another edition, or a different remote access tool.
No. Moving Remote Desktop to a different port only hides it from the laziest scans. Attackers scan all ports, so it is not real protection.
NLA makes users authenticate before a full remote session is established, which reduces exposure to some attacks. It should stay switched on.
They can be, as they avoid opening ports, but they hold your access through their service. Use strong passwords and two-step verification, and keep them updated.
Rather have it done properly?
Get a clear, fixed quote from a local engineer before any work starts.