Restrict the approach
Avoid exposing RDP to the whole internet where a gateway, VPN or source-address restriction can meet your needs. Enable supported authentication protections and keep the operating system current.
Separate accounts and privileges
Give each person an individual account and reserve administrator access for administration. Use strong unique passwords and a suitable multi-factor solution where supported. Remove accounts and sessions that are no longer needed.
Keep files and recovery portable
Back up working files outside the desktop, document software licences and retain a rebuild procedure. A saved remote desktop connection file should not become an unprotected container for sensitive credentials.
Watch the right signals
Review authentication events, unexpected services, security alerts and disk capacity. If compromise is suspected, isolate the machine and recover from a trusted source rather than trusting a single clean scan.