How to Fix RDP Port 3389, Services, and Firewall on a Windows VPS

If your Windows VPS remote desktop cannot connect, do not start by changing random settings. You must work in a safe order. Check that the server is on, open the provider console, test port 3389, check the RDP service, then check the firewall and NLA. This guide shows each step with PowerShell commands.

Most RDP problems come from one of the following things:

• The server is off
• The network blocks port 3389
• Remote Desktop service is stopped
• Login is rejected

You can fix them with the following steps in order. Remember to not turn off the firewall and do not open RDP to the whole internet.

First, you must log in to your hosting panel. Confirm the VPS is running, and check that its public IP is the one you are using. If the server is off, start it. If it is stuck, reboot it from the panel.

Then, open the provider’s remote console, such as VNC or KVM. This console works even when RDP is down, so it is your safe way back in. Log in as Administrator and run all the PowerShell commands below in the console. 

If you are choosing a new server, a Windows VPS with console access makes recovery much easier.

This step shows if the network is the problem. On your own computer, open PowerShell and run:

If the Windows VPS remote desktop cannot connect, look at TcpTestSucceeded. If it is True, the network path works, so the problem is on the login or session side. If it is False, the port is blocked, closed, or nothing is listening. Move to the next steps.

Also, you must check your provider’s firewall or security group. It must allow TCP 3389 from your IP address.

If port 3389 is open but you still can't connect, the Remote Desktop service may be stopped. In the console, check the Remote Desktop Services service (TermService):

Microsoft says both services must be running on the server. If the Windows VPS remote desktop cannot connect after a restart, check that RDP is turned on in the registry. The value fDenyTSConnections must be 0:

The service can be running while Windows still does not listen for RDP connections. The RDP listener is what waits for new connections on port 3389. Check that it is active and that the port number is correct:

In qwinsta, the rdp-tcp line should show Listen. If nothing listens, restart the service:

Restarting this service can end your current RDP session, so do it from the console. Next, check that the port number is really 3389:

If the value is not 3389, connect with IP:port, or set it back to 3389 and restart the service.

If the service and listener are fine, Windows Firewall may be blocking your connection. Do not turn the firewall off. Instead, turn on the Remote Desktop rules and allow access only from your own IP address:

If your IP usually changes, you can use a VPN with a fixed IP and allow only that address. To check that the rules are on, run:

You must be careful. If you enter the wrong IP, you will block yourself. You can fix this from the provider console.

If the network, service, and firewall are fine, the problem may be your login. Network Level Authentication (NLA) checks your login before the session starts. Check NLA with:

A value of 1 means NLA is on. If the Windows VPS remote desktop cannot connect with a login error, it is rarely an NLA bug. You must check these first:

• The password is correct, and the account is not locked.
• The user is an Administrator or in the Remote Desktop Users group.
• Your RDP client is up to date.

To add a user, you can run: 

If you must turn NLA off for testing, turn it back on right after.

The error you see tells you where the problem is. A timeout, a refused connection, and a login error each point to a different cause. You can use this table to find your error and see what to check first.

Once you are back in, take a few minutes to make RDP safer. Most RDP problems come back when the server is open to everyone. These simple habits help keep your server protected:

• Allow only trusted IP addresses.
• Use strong passwords.
• Install Windows updates.
• For heavy workloads that need more control, consider a reliable dedicated server.
• If the Windows VPS remote desktop cannot connect again, start from Step 1 and the console.

When the Windows VPS remote desktop cannot connect, the fix is easy if you follow the right order. Check the power and console first. Then, test port 3389, check the service and listener, and fix the firewall and NLA. Never turn off the firewall, and never open RDP to everyone.

We hope you enjoy this RDP connection troubleshooting guide.