Connecting through VPN then through RDP

In simple terms: the vpn creates a virtual tunnel between the end user and your vpn device (using your example of an end user connecting remotely to your office) using encryption protocols.  You can have the user authenticate using a variety of methods depending on your vpn device capabilities and your network configuration. Once the vpn is session is established you can have your end users RDP or access the internal resources as if he\she was in the office. It will help you because theoretically braking the vpn session is very difficult, I advise everyone to stop doing port forwarding to windows machines and implement a vpn solution.

hope it helps.

VPN, if setup correctly, it much more secure than simply opening RDP up to the outside world. At a minimum, you would want to restrict the RDP ports to the remote users IP / IP range at the very least.

Using VPN with encrypted tunneling and certificate(s) is vastly more secure than direct RDP port access.
VPN (if setup correctly) will establish a secure, encrypted, certificate based pathway into the network hosting the RDP server, which the remote user can then connect to. If the remote user does not have the corresponding certificate for that user, then no access is granted. Depending on which VPN tech you choose, more safe guards can be added, including 2FA, restricting from IP addresses, etc.
The VPN field is simply so vast, it would be impossible to give all the options here, but to answer your question, yes, secured VPN would be much better than what you are doing now.

Just thinking logically, would already put you on the VPN path. Bruteforcing TWO things (VPN + RDP) takes longer and is MORE difficult than bruteforcing ONE thing (RDP only). Heck, if you don't like your VPN solution, just buy a new router, and voila, new VPN solution.

Thank you all for your responses.  We have deployed a hardware-based security appliance (i.e. firewall with VPN capability), and we very much like the additional security features that are included.  However, our question still remains... perhaps we are missing something obvious.

To connect an outside user through the VPN to the internal network, and then to a desktop using RDP, still only requires a free downloaded VPN client, a username, and a password.  Granted, once the connection is made it is encrypted, but still, all that has essentially been required is a username and password - no different than the old straight, port-forwarded, RDP method.  Would someone please elaborate on how this is, in and of itself, more secure than straight RDP?

Thanks all... it appears certificates are the key.  We'll put that in place.  Thanks for all of your helpful comments.