Install Windows Server on a VPS: Templates, Custom ISO, and First-Boot Hardening

Installing Windows Server on a VPS is not the same as installing it on a laptop. There is no optical drive, the guest boots from a provider template or an uploaded ISO, and the first thing you should verify is whether the machine is reachable over RDP. This walkthrough covers template deployment, custom ISO installs with the virtio drivers that KVM requires, unattended setup, and the post-install hardening steps that keep a new Windows box from being compromised within hours.

Step 1: Choose the Edition and Size

Providers offer two flavors of Windows template: evaluation builds (Windows Server 2022/2025 Evaluation) and licensed builds (Standard or Datacenter with per-core licensing bundled). Evaluation expires after 180 days and cannot be legally upgraded to full licensing without a purchased key, so use it only for testing.

Edition	Best for	Guests / notes
Server 2025 Standard	IIS, .NET apps, small SQL Server	2 Hyper-V guests; per-core licence
Server 2025 Datacenter	Dense virtualization	Unlimited guests, higher cost
Server 2022 Standard	Legacy .NET Framework workloads	Longer track record, same tooling
Server Core	Minimal footprint, remote management	No GUI; lower RAM and patch surface
Evaluation (any)	Lab only	Expires in 180 days

Size the plan realistically: start at 2 vCPU, 4 GB RAM, and 60 GB SSD. Windows Server idles around 1.3–1.9 GB RAM, and Windows Update plus the page file need headroom. For a comparison of what different tiers cost and include, review the Windows VPS plans listed on windows-vps.org.

Step 2: Deploy From a Provider Template

Template deployment is a single click. The provider writes the image, runs the Sysprep specialize pass, and the guest reboots into the desktop or the Core console. Choose the locale, set the Administrator password at first boot, and confirm the network adapter received a DHCP lease before doing anything else.

ipconfig /all
Test-NetConnection 8.8.8.8 -InformationLevel Quiet

Step 3: Custom ISO Install (When You Must)

If you need a specific build, upload the ISO through the provider’s console. On KVM-based hosts the critical detail is the storage driver: a stock Windows ISO has no virtio-scsi driver, so the installer will not see the disk. Attach the virtio-win ISO as a second CD and load vioscsi or virtio-blk at the “Where do you want to install Windows?” screen.

• Attach both the Windows ISO and the virtio-win ISO before boot.
• At disk selection, choose Load driver and browse the virtio CD’s vioscsi\2k25\amd64 folder.
• Install the guest tools/agent after first boot for time sync, ballooning, and graceful shutdown.

Step 4: Unattended Installation

For repeatable builds, use an autounattend.xml answer file placed at the root of a small secondary ISO. A minimal file sets the locale, disk layout, Administrator password, and computer name, and enables Remote Desktop automatically so you never need console access again.

<settings pass="oobeSystem">
  <component name="Microsoft-Windows-Shell-Setup">
    <ComputerName>WEB01</ComputerName>
  </component>
  <component name="Microsoft-Windows-TerminalServices-LocalSessionManager">
    <fDenyTSConnections>false</fDenyTSConnections>
  </component>
</settings>

Step 5: Harden Before You Put It Online

A fresh Windows box with port 3389 open and a weak password is compromised in minutes by automated scanners. Do these steps before the server carries real traffic:

• Rename the Administrator account and disable the built-in Guest.
• Enable Network Level Authentication for RDP and restrict source IPs in the firewall.
• Run Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled True.
• Enable Windows Update and set an active hours window so reboots do not interrupt you.
• Turn on System Restore or a snapshot schedule so a bad change is reversible.

# Require NLA and set a sane idle limit
Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name UserAuthentication -Value 1
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services' -Name MaxIdleTime -Value 3600000

Step 6: Validate the Build Before Handing It Over

Before you call the install finished, run a short validation pass so you are not discovering problems from a customer. Check that the guest reports the expected edition and build, that activation is licensed rather than in notification mode, that Windows Update has run at least once, and that a snapshot exists. This habit turns a one-off install into a template you can trust.

Get-ComputerInfo | Select-Object WindowsProductName, WindowsVersion
cscript.exe C:\Windows\System32\slmgr.vbs /dlv
Get-CimInstance Win32_LogicalDisk -Filter "DeviceID='C:'" | Select-Object Size, FreeSpace

Repeatability is the other half of a good install. Once the validation pass is clean, snapshot the machine and keep the unattended answer file alongside the snapshot. Rebuilding a broken node then becomes a restore-plus-answer-file operation rather than an afternoon of manual clicking — exactly the property you want on a VPS where the provider console is your only out-of-band access.

Common Install Failures

Symptom	Cause	Fix
No disk listed at install	Missing virtio storage driver	Load vioscsi from the virtio-win ISO
Stuck on “Getting ready”	Slow storage / insufficient RAM	Increase to 4 GB RAM, confirm SSD backing
RDP refused after install	Firewall or NLA mismatch	Enable RDP rule, verify port 3389 reachable
Network unreachable	DHCP not issued / static misconfigured	Set a static IP from the provider’s range

Next Steps

Once RDP is stable, promote the box for its role — install IIS and the .NET Hosting Bundle, join it to a domain, or configure RDS. If you are still choosing a base platform, compare Windows Server VPS hosting on windows-vps.org so the template, licences, and snapshot options match how you intend to use the server.