Seven ways to lock down Remote Desktop
RDP on the open internet is a scanner's favorite port. Shrink the attack.
Change the initial Administrator password. Use a strong, unique one. Restrict 3389 to known IPs in the Windows firewall. NLA should stay on.
Keep Windows patched. Do not browse the web as Administrator. Consider a VPN (Outline or OpenVPN on the same or another VPS) and RDP only on the tunnel. Disable unused accounts. Watch failed logons.
Noble VPS will not make RDP "unhackable." Exposure times patience, and scanners have a lot of it.