"rdp exposed to internet" - this is the biggest issue. Don't be in the DMZ with your machines! I have an openssh server running (no password but unique credentials) and need to connect to my VPN in order to interact with my machines. Everying else just asks for hackers.