Sanu VargheseIT & AI notes
Tutorials › Networking
IntermediateNetworking · about 15 min · 4 November 2026

Limit Remote Desktop on Windows Server to your management network

By default, the Remote Desktop rules in Windows Firewall accept connections from any address. If a server only ever needs RDP from your admin machines or a management subnet, you can limit the rules to those addresses. Anyone else is then blocked by the firewall before they even see a login prompt. This guide does it with the GUI first, then with PowerShell.

Before you start

  • You need local administrator rights on the server.
  • Decide which addresses should be allowed. For example a management subnet such as 10.10.99.0/24, or the IP addresses of a jump box or VPN pool. The examples below use 10.10.99.0/24. Replace it with your own.
  • Know how you'll get back in if it goes wrong: Hyper-V or VMware console, iLO or iDRAC, or someone on site.
This can lock you out. If you are connected over RDP from an address that isn't in your allowed list, your session will drop when you apply the change and you won't be able to reconnect. Always include the address you're working from, and have console access ready before you start.
If the server is managed by Group Policy or Intune, a firewall policy may already set or override these rules. Check with whoever owns that policy first, and make the change there instead if it's centrally managed.

Step 1: Find your own IP address

  1. On the machine you connect from, open a command prompt and run ipconfig.
  2. Note the IPv4 Address. Check it falls inside the range you plan to allow. If it doesn't, add it to the list as well.

Step 2: See the current Remote Desktop rules

  1. On the server, right-click Start and choose Windows PowerShell (Admin) or Terminal (Admin).
  2. Run the command below. It lists each Remote Desktop rule, whether it's on, and which remote addresses it accepts.
Get-NetFirewallRule -DisplayGroup "Remote Desktop" |
  ForEach-Object {
    [pscustomobject]@{
      Name    = $_.DisplayName
      Enabled = $_.Enabled
      Profile = $_.Profile
      Remote  = ($_ | Get-NetFirewallAddressFilter).RemoteAddress -join ", "
    }
  } | Format-Table -AutoSize

On most servers you'll see rules such as Remote Desktop - User Mode (TCP-In) and (UDP-In), with Remote showing Any. That means anyone who can reach the server can try to log in. On a non-English server the group name may be translated.

Step 3 (GUI): Limit the rules to your management addresses

  1. Press Windows + R, type wf.msc and press Enter. The Windows Defender Firewall with Advanced Security console opens.
  2. In the left pane, click Inbound Rules.
  3. In the right pane, click Filter by Group and choose Filter by Remote Desktop. Only the Remote Desktop rules are shown.
  4. Double-click Remote Desktop - User Mode (TCP-In). The rule's Properties window opens.
  5. Click the Scope tab.
  6. Under Remote IP address, select These IP addresses, then click Add.
  7. In the IP Address box, type your subnet, for example 10.10.99.0/24, or a single address, and click OK. Repeat Add for each address or range you need, including the one you're connected from.
  8. Click OK to save the rule.
  9. Repeat steps 4 to 8 for Remote Desktop - User Mode (UDP-In) and any other enabled rule in the group, such as Remote Desktop - Shadow (TCP-In).

Step 3 (PowerShell): The same change in one command

If you prefer PowerShell, this sets the allowed remote addresses on every rule in the group at once. You can give a single address, a subnet or a range, and list more than one, separated by commas.

Set-NetFirewallRule -DisplayGroup "Remote Desktop" -RemoteAddress "10.10.99.0/24","10.10.50.25"

If you only want to allow the server's own local subnet, Microsoft provides a keyword for that:

Set-NetFirewallRule -DisplayGroup "Remote Desktop" -RemoteAddress LocalSubnet

Check it worked

  1. Run the command from Step 2 again. The Remote column should now show your addresses instead of Any.
  2. From an allowed machine, open Remote Desktop Connection (mstsc) and connect to the server. It should work as before.
  3. From a machine that is not in the allowed list, run Test-NetConnection <server> -Port 3389. TcpTestSucceeded should be False. If it's True, another rule is still letting RDP in.

If it doesn't work

  • Still reachable from everywhere: look for other inbound rules that allow TCP 3389, for example a custom rule someone added. Windows Firewall has no rule ordering: if any allow rule matches, the traffic is allowed, unless an explicit block rule also matches.
  • Locked out: log in through the VM console or iLO/iDRAC and put the rules back to any address with Set-NetFirewallRule -DisplayGroup "Remote Desktop" -RemoteAddress Any, then try again with the right addresses.
  • Your change keeps reverting: a Group Policy or Intune firewall policy is probably managing the rules. Make the change there.

Sources

← All tutorials
Esc