A Windows workspace. Your access rules.

A remote desktop is still a server

The Windows environment runs on hosted infrastructure and is reached through Remote Desktop Protocol. The experience depends on the distance to the location, available bandwidth and the kind of work you do. A responsive terminal session and a graphics-heavy desktop have very different requirements.

Put the login behind a boundary

Use a unique administrator password, supported Windows updates and Network Level Authentication. Restrict the source addresses that can reach RDP or place it behind a secure gateway or VPN. Exposing a weak login to the public internet is an avoidable risk.

Licensing comes before deployment

Windows edition, activation rights, Remote Desktop Services user access and third-party application licences must match the intended use. Check exactly which licence rights are included with your order. Do not assume a desktop licence covers a multi-user hosted service.

Keep working data portable

Save important files to a controlled repository or encrypted backup outside the desktop. A workstation can be rebuilt; the only copy of a project cannot. Set an idle lock policy and sign out sessions you no longer need.

Windows image choices

Compare the five Windows editions listed in the configurator. Confirm availability, licence rights, activation and permitted user sessions for the selected order.

• Windows Server 2025
• Windows Server 2022
• Windows Server 2019
• Windows 11 IoT Enterprise
• Windows 10 IoT LTSC 2021

Keep the desktop behind an access boundary

For a restricted RDP configuration, keep TCP port 3389 closed to the public internet until an approved source-IP allow-list is applied. A WireGuard-only connection is an alternative: keep the public RDP port closed and reach the desktop over the private tunnel. Verify the applied firewall rules before opening the desktop to users. Final orders must define licence coverage, snapshots, mitigation and support scope. A Windows edition label alone does not grant hosting or multi-user rights.

Read the edition’s actual use rights

Microsoft describes Windows IoT Enterprise as intended for fixed-purpose devices, with licensing and distribution distinct from ordinary desktop editions. RDS session-host access has its own client-access licensing model. These catalogue labels require a verified lawful hosting and user-access arrangement before activation; a name in an image menu is not proof of those rights.

Microsoft: Windows IoT Enterprise · Microsoft: RDS client-access licensing

Team sessions and custom CAL counts

Warden Remote is specified for a five-user Remote Desktop Services target. Larger Guardian Remote, Vanguard Remote and Apex Remote allocations, or a custom CAL request, need an individual engineering review; no exact higher-tier user count or CAL surcharge is published. The licensing programme, permitted Windows edition and per-user or per-device entitlements must be confirmed before activation. A concurrent-session target does not replace the required CAL entitlement.

Changes and recovery

Plan a reboot when changing desktop resources, and check the available reinstall and snapshot-restoration options before making changes. Reinstall and restore can overwrite current data. Keep working files backed up independently and plan the interruption before changing a production desktop.

Clear monthly and annual terms

All five Windows RDP tiers offer monthly billing or an upfront payment for one 12-month period, saving 30% compared with 12 separate monthly payments. The annual total is 12 times the listed monthly price multiplied by 0.70, rounded once to cents. The listed price includes the stated licence arrangement and no setup charge. Check the licence scope, renewal timing, cancellation rules, refunds and retention after closure in the applicable terms.

Five images, with licensing identified at order time

The Windows catalogue lists Windows Server 2022 as the default, plus Server 2025, Server 2019, Windows 11 IoT Enterprise and Windows 10 IoT LTSC 2021. Image availability and licensing must match the final service agreement. An included Windows licence does not by itself grant unlimited simultaneous Remote Desktop Services users or licences for third-party software.

Make the desktop reachable by the intended people

The intended RDP access policy restricts the remote desktop port to authorised source addresses rather than leaving a weak login open worldwide. Add the administrator’s permitted network before testing access. Use Network Level Authentication, a unique password and supported updates. If users move between networks, plan an authenticated gateway or VPN and document a safe way to update the allow-list.

Move working files before rebuilding

Treat a Windows reinstall as a destructive change. Export application configuration, repositories, profiles and necessary licence information without exposing secrets. Verify that the backup opens on another machine. After rebuilding, check updates, time synchronisation, the access allow-list and an ordinary user session before restoring a busy desktop.