How to Connect to a Windows VPS via RDP

In short

To connect to a Windows VPS, copy its public IP address, open an RDP client, enter the IP, sign in with Administrator, and use the password set during VM creation. On Windows, Remote Desktop Connection (mstsc) remains Microsoft's generally available client for direct remote-PC connections. On macOS, iOS, iPadOS, and Android, use Windows App. Keep Network Level Authentication enabled and restrict direct RDP exposure where practical.

If you do not have a Windows VPS with RDP yet, see RDP VPS hosting on Raff.

The Windows VPS RDP login takes six steps

For a standard Raff Windows VM, the first connection is:

1. Confirm the Windows VM is Running.
2. Copy its Public IPv4 address.
3. Open your Remote Desktop client.
4. Enter the public IP address.
5. Sign in as Administrator with your VM password.
6. Verify the server identity and complete the connection.

The normal direct-RDP port is 3389. Microsoft documents both TCP and UDP 3389 for direct Remote Desktop traffic, although the exact transport used by a session can depend on the client and network path.

If you are still choosing a server rather than connecting to one you already own, see Raff Windows VM. This guide is intentionally focused on connection and first login, not broad Windows VPS purchasing intent.

Use the right Remote Desktop client in 2026

Microsoft's client lineup has changed, so use the client that is currently supported for your platform and connection type.

For Windows users, there is no need to replace mstsc just because Windows App exists. Microsoft currently directs users who want a generally available Windows remote-PC client to continue using Remote Desktop Connection.

You need the IP address, Administrator account, and password

Before connecting, prepare:

• a Raff Windows VM with status Running;
• its Public IPv4 address;
• the Administrator password set during VM creation;
• an RDP client on your local device;
• network access to the RDP service.

The standard Raff first-login username is:

Administrator

If your RDP client tries to use a different local or Microsoft account automatically, use:

.\Administrator

The . tells Windows to use the remote server's local account database rather than a domain account.

Get the Windows VPS IP from the Raff dashboard

The existing Raff dashboard workflow for this guide is:

1. Sign in to the Raff dashboard.
2. Open Compute → All Virtual Machines.
3. Select your Windows VM.
4. Confirm the VM is Running.
5. Copy the Public IPv4 address.

You set the Administrator password during VM creation. Save it in a password manager rather than relying on a browser tab or temporary note.

Reset the password if you no longer have it

If the Administrator password is lost, use the password-reset action from the VM details page rather than repeatedly guessing credentials.

After a reset:

1. wait for the reset operation to complete;
2. remove any stale saved credentials from the RDP client if necessary;
3. reconnect with Administrator and the new password.

Repeated failed sign-ins can trigger account-lockout behavior if a lockout policy is configured.

Connect from Windows with Remote Desktop Connection

Remote Desktop Connection is built into supported Windows versions and remains the simplest generally available path for a direct Windows VPS connection.

1. Press Win + R.
2. Enter:

mstsc

3. Select OK.
4. In Computer, enter the Windows VPS public IP.
5. Select Show Options if you want to enter the username before connecting.
6. Use:

Administrator

7. Select Connect.
8. Enter the Administrator password.
9. Review the certificate/server-identity prompt before continuing.

Microsoft also supports launching a connection directly from the command line:

mstsc /v:203.0.113.42

Replace the documentation IP with your actual server address.

Save the RDP profile if you connect often

In Remote Desktop Connection:

1. select Show Options;
2. configure the server and username;
3. select Save As;
4. save the .rdp file in a controlled location.

Do not distribute an .rdp file together with shared credentials. Each administrator should have an attributable account where the environment requires it.

Connect from macOS with Windows App

Microsoft Windows App is the current Microsoft client for direct remote-PC connections on macOS.

1. Install Windows App from the Mac App Store.
2. Open Windows App.
3. Add a new PC.
4. Enter the Windows VPS public IP as the PC name.
5. Add or enter the Administrator account.
6. Enter the password.
7. Save and open the connection.
8. Review the certificate prompt before accepting it.

Windows App can also configure display resolution, multiple monitors, clipboard behavior, audio, and device/folder redirection depending on platform support and policy.

Connect from iPhone, iPad, or Android with Windows App

Microsoft also provides Windows App on iOS, iPadOS, and Android/ChromeOS.

The connection details remain the same:

PC name: <your Windows VPS public IP>
Username: Administrator
Password: <your Windows VPS password>

On iPhone or iPad:

1. install Windows App;
2. tap the add button;
3. add a PC;
4. enter the VPS IP address;
5. save the connection;
6. enter the Windows credentials when prompted.

On Android/ChromeOS, add the remote PC in Windows App using the same IP and credentials.

Mobile RDP is useful for emergency administration and quick checks. For long server-management sessions, a desktop client is usually more practical.

Linux clients can use Remmina or FreeRDP

Linux does not use a Microsoft Windows App client for this workflow. Common choices are Remmina and FreeRDP.

On Ubuntu/Debian, Remmina can be installed with:

sudo apt update
sudo apt install remmina remmina-plugin-rdp

Then create an RDP profile with the server IP and Administrator credentials.

FreeRDP can also connect from a terminal. Use its current client syntax for the version installed by your distribution and avoid options that globally disable certificate validation unless you are diagnosing a controlled test environment.

Because Remmina and FreeRDP are third-party/open-source projects, use their current project documentation for distribution-specific package and certificate options.

A first-time certificate warning is expected, but verify the server

A fresh Windows Server commonly presents an RDP certificate that your client cannot validate through a public certificate authority, especially when you connect by raw IP address.

Before accepting the prompt, confirm:

• the IP matches the VM in your Raff dashboard;
• you intentionally initiated the connection;
• the warning is consistent with a first connection or known certificate change.

Do not turn certificate validation off globally just to remove the prompt.

If an established server suddenly presents a different certificate or fingerprint without an expected configuration change, investigate before continuing.

Verify that the RDP session reached the correct Windows Server

After login, open PowerShell and verify the operating system:

Get-ComputerInfo | Select-Object CsName, OsName, OsVersion, OsBuildNumber

Check the network configuration:

ipconfig

And confirm the Remote Desktop Services service is running:

Get-Service TermService

A healthy service state should report Running.

These checks are especially useful when you manage several Windows VMs and want to verify that you connected to the intended server.

Keep Network Level Authentication enabled

Microsoft recommends Network Level Authentication (NLA) for most environments. NLA requires authentication before the full remote session is created and reduces the resources exposed to unauthenticated users.

If an old client cannot connect because the server requires NLA, update the client first. Disabling NLA should be a controlled compatibility exception with a recovery path, not the default troubleshooting step.

Direct public RDP should be an administrative access path, not a team architecture

Connecting directly to a public Windows VPS address is simple, but exposing Remote Desktop broadly to the internet increases the server's authentication attack surface.

For a small admin-only deployment:

• keep NLA enabled;
• use strong unique credentials;
• restrict RDP to trusted source IPs where practical;
• keep Windows patched;
• monitor failed sign-ins;
• preserve a console/recovery path before changing firewall rules.

For teams, changing source networks, or sensitive workloads, consider a VPN or Remote Desktop Gateway rather than relying on a broadly reachable direct RDP endpoint. See RD Gateway vs Direct RDP for the architecture decision and Configure Windows Firewall for source restriction and rule scope.

Administrative RDP is different from a multi-user RDS deployment

A Windows Server VM can be administered through Remote Desktop without turning the server into a shared employee desktop.

Use administrative RDP for:

• server setup;
• patching;
• software installation;
• troubleshooting;
• occasional maintenance.

If employees need separate Windows sessions or RemoteApp for daily work, plan Remote Desktop Services (RDS) Session Host and the correct Microsoft licensing model. The two built-in administrative connections are not employee desktop licenses.

Use Multi-User RDP vs RDS Session Host before onboarding daily users.

Most RDP connection failures fit five checks

When Remote Desktop cannot connect, troubleshoot in this order:

1. VM state — confirm the Windows VM is Running.
2. IP address — compare the address in your client with the dashboard.
3. Credentials — use Administrator or .\Administrator with the current password.
4. Network path — confirm your local network can reach TCP 3389.
5. Server policy/firewall — confirm RDP is enabled, allowed through Windows Firewall, and NLA/client compatibility is correct.

On a Windows client, test TCP reachability:

Test-NetConnection 203.0.113.42 -Port 3389

A successful TcpTestSucceeded proves that the TCP listener is reachable. It does not prove that credentials, NLA, RDS policy, UDP transport, or the desktop session itself will succeed.

“Your credentials did not work” usually means account or cached-credential trouble

Try this sequence:

1. Confirm Caps Lock and keyboard layout.
2. Enter the password manually rather than pasting it from an uncertain source.
3. Use Administrator.
4. If Windows is trying another account context, use .\Administrator.
5. Remove stale saved credentials from the client.
6. Reset the Raff VM password if the current password is unknown.

Do not weaken CredSSP or NLA policy as the first response to a credential error.

“Remote Desktop can't connect to the remote computer” usually means reachability

Check:

• the VM is powered on;
• the public IP is correct;
• your office/VPN/firewall is not blocking outbound RDP;
• Windows Firewall still permits the intended connection;
• RDP was not disabled inside Windows;
• TCP 3389 is reachable from the client network.

If a corporate network blocks RDP, test from another approved network to isolate whether the problem is local or server-side.

If Windows Firewall rules changed immediately before the failure, use the documented recovery path rather than opening every port. The detailed safe workflow is in Configure Windows Firewall.

CredSSP errors should be fixed by updating both sides

A message such as:

An authentication error has occurred.
The function requested is not supported.

can appear when the client and server have incompatible CredSSP security-update states.

The preferred fix is to update both the local client and Windows Server. Avoid old registry recipes that reduce CredSSP protection simply to make a connection succeed.

Black screens and slow sessions are a separate performance problem

If authentication succeeds but the session opens to a black screen, freezes, or becomes slow, the connection problem may have moved beyond basic login.

Check:

• Windows Update or first-boot work still running;
• server CPU/RAM pressure;
• client resolution and monitor count;
• network latency or packet loss;
• user-profile problems;
• applications consuming server resources.

For a systematic diagnosis, use RDP Performance Tuning.

Clipboard and file redirection depend on client and server policy

If copy/paste does not work, check that clipboard redirection is enabled in the client and not blocked by server or RDS policy.

On a Windows session, restarting the clipboard process can help when the feature is enabled but stuck:

Stop-Process -Name rdpclip -Force
Start-Process rdpclip.exe

For local-drive redirection in mstsc:

1. open Show Options;
2. select Local Resources;
3. select More;
4. enable only the drives or devices you need;
5. reconnect.

For sensitive servers, redirect the minimum required local resources rather than exposing the entire client filesystem to the session.

Secure the Windows VPS immediately after first login

A successful RDP connection is the start of server administration, not the end of setup.

After first login:

1. Run Windows Update.
2. Confirm the Administrator password is strong and unique.
3. Create attributable admin accounts if multiple people manage the VM.
4. Keep NLA enabled.
5. Review Windows Firewall and narrow RDP exposure where practical.
6. Do not expose SMB, SQL Server, WinRM, or other management ports broadly.
7. Enable backups or snapshots before installing business-critical software.
8. Monitor failed sign-ins and unexpected account activity.

For the broader baseline, use the Windows Server Hardening Checklist.

Tested on Raff

The original connection workflow was tested on a Raff Windows VM running Windows Server 2025 using Remote Desktop Connection (mstsc) on Windows and Windows App on macOS. The Raff dashboard screenshot and first-login workflow above are preserved from that earlier test. This September 2026 refresh revalidated the Microsoft client, NLA, and remote-access guidance against current Microsoft documentation; it does not claim a new live Raff connection test or a new dashboard screenshot.

What's next

• RDP Performance Tuning — fix lag, latency, and session performance after login.
• Multi-User RDP vs RDS Session Host — decide when admin RDP is no longer enough.
• RD Gateway vs Direct RDP — choose a safer access architecture for teams.
• Configure Windows Firewall — narrow RDP and other inbound rules safely.
• RDP VPS — deploy another Windows Server environment.

Sources

• Microsoft Learn — Enable Remote Desktop
• Microsoft Learn — Connect to Windows devices and apps with Windows App
• Microsoft Learn — What is Windows App?
• Microsoft Learn — Remote Desktop access from outside your network
• Microsoft Learn — mstsc command reference
• Microsoft Learn — Remote Desktop clients FAQ
• Remmina project documentation
• FreeRDP project documentation
• Sources revalidated: 2026-09-09