RDP into a Windows machines through a secure SSH bastion host that forwards RDP packets to the Windows host.
Use RDP on localhost 3389 to connect through the SSH tunnel and the remote SSHD at the bastion server will forward to the windows server.
Replace 3389 with any other port you need forwarded to a remote host.
<Your Laptop> 3389:localhost --> <SSH Bastion Proxy server> --> 3389:Windows host
ssh -L windowshost:3389 root@ssh_bastion_host