Connect to a Windows node

Remote Desktop (RDP) gets you onto your Windows node’s desktop. You need the node’s public IP, from its detail page, and the username and password from your creation email.

Before you connect, make sure the node’s security group allows inbound TCP port 3389 from the source you are connecting from, and that Windows Firewall inside the node allows the same port. Most connection failures come from one of those two, not from the node’s status in the portal.

Connect over Remote Desktop

E2E emails you the node’s username and password as soon as it is created. Which client you use depends on the computer you are connecting from.

From Windows

Open the built-in Remote Desktop Connection app (search for it, or run mstsc). Enter the node’s public IP as the computer, then sign in with the username and password from your creation email.

From macOS

Install Microsoft Remote Desktop from the Mac App Store. Add a new PC, enter the node’s public IP as the PC name, then sign in with the username and password from your creation email.

From Linux

Install an RDP client such as Remmina from your distribution’s package manager. Create a new RDP connection, enter the node’s public IP, then sign in with the username and password from your creation email.

Once you sign in, the node’s Windows desktop opens.

If your RDP client shows a certificate warning, that is expected: Windows Server uses a self-signed certificate for RDP by default, which your client will not already trust. Confirm the IP address in the warning matches the node you meant to reach, then continue.

RDP connects straight to the node over the network. Whenever the node is reachable on the network, RDP works, whatever status the portal shows; locking a node, for example, leaves RDP open. If the connection times out or is refused, see Troubleshooting: networking and connectivity.

Common Remote Desktop connection problems

What you see	Likely cause	What to do
Connection times out	Port 3389 is blocked, the node has no reachable IP, or the route is unavailable.	Check the public IP, the security group, and Windows Firewall on the node.
Sign-in is rejected	The username or password is wrong, or the password changed since the email was sent.	Use the latest password, or change it from the node’s Security tab.
RDP connects but drops right away	Windows is still starting its services, or the node is under heavy load.	Wait a few minutes and retry; use Access Console if it keeps happening.
A certificate warning appears	Windows Server’s default self-signed RDP certificate is not trusted by your client.	Confirm the IP matches your node, then continue.
Security group looks right but it still fails	Windows Firewall on the node can block the port even when the security group allows it.	Open Access Console to check Windows Firewall from inside the node.

Before you rely on Remote Desktop in production

• Restrict the security group’s inbound port 3389 to the sources that actually need it, not every address.
• Do not share the Windows password over chat or a support ticket.
• Change the password once you are done sharing temporary access.
• Prefer a VPN, bastion, or private network path over exposing RDP to the internet.
• Keep Access Console available as a fallback for emergency access.
• Recheck the security group whenever you attach or change the node’s public IP.

Change the password

Change your node’s password from its Security tab; see Change the node password. A Windows password must be 16 to 30 characters, with a number, an uppercase letter, a lowercase letter, and a special character. You cannot change it while the node is locked. Changing it emails you the new password along with the IP address the change came from.

When RDP will not connect at all, the node’s console still shows the Windows screen in your browser; see Open a node’s console.