If you have a server facing the Internet and you want to have RDP open on it, the least you can do is to change RDP port, just makes simple sense.
So, first change the port RDP will listen to via running regedit and changing HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp\PortNumber in decimal node to something other than 3389, lets say port 3355 for the sake of this exercise.
Now, before you reboot change the incoming open firewall port on the server to that same port or you won’t be able to RDP in. Simple Powershell line: netsh advfirewall firewall add rule name=”Open Port 3355″ dir=in action=allow protocol=TCP localport=3355
Now I run some stuff in Azure, so I change my RDP port there too. When that is done, reboot 🙂