Everyday Windows VPS Administration: Services, Scheduled Tasks, Logs and Disk Housekeeping

Daily administration of a Windows VPS reduces to four recurring activities: keeping services running, keeping scheduled tasks executing, keeping logs readable, and keeping the system drive from filling. This is the operational checklist for each.

Know What Is Actually Running

Before changing anything, establish a baseline of automatic services that are not running. On a fresh Windows Server VPS this list should be nearly empty — anything on it is a fault or an intentionally disabled service you should document.

Get-Service | Where-Object { $_.StartType -eq 'Automatic' -and $_.Status -ne 'Running' } |
  Select-Object Name, DisplayName, Status | Format-Table -AutoSize

# export a baseline you can diff after patching
Get-Service | Select-Object Name, StartType, Status |
  Export-Csv C:\baseline\services-$(Get-Date -f yyyyMMdd).csv -NoTypeInformation

For a specific service with a dependency chain, read the dependencies before restarting, otherwise you will take down IIS while restarting WAS:

Get-Service -Name W3SVC -RequiredServices
Get-Service -Name W3SVC -DependentServices

Recover Services Automatically

A service that crashes once will crash again. Rather than watching it, set a recovery policy so Windows restarts it without a human:

sc.exe failure MyService reset= 86400 actions= restart/5000/restart/10000/restart/30000
sc.exe qfailure MyService

The reset= value is in seconds and controls how long the failure counter persists; 86400 gives you one day. These settings survive reboots and are the cheapest reliability win on any VPS.

Scheduled Tasks: Verify, Do Not Assume

Scheduled tasks fail silently more often than services do. The usual causes are a stored password that changed, or a “run whether user is logged on or not” task whose account lost Log on as a batch job. Query the last result code for every non-Microsoft task:

Get-ScheduledTask | Where-Object TaskPath -notlike '\Microsoft\*' | ForEach-Object {
  $info = $_ | Get-ScheduledTaskInfo
  [pscustomobject]@{
    Task = $_.TaskName
    LastRun = $info.LastRunTime
    Result  = $info.LastTaskResult
    NextRun = $info.NextRunTime
  }
} | Where-Object Result -ne 0 | Format-Table -AutoSize

Result 0 is success, 0x41303 means it has never run, and 0x1 is a generic script failure — check the task’s own log output rather than the Task Scheduler history, which truncates quickly. Automating backups and maintenance this way is covered in depth in our Task Scheduler automation guide.

Event Logs Without the Noise

The Windows event log is mostly informational. Filter to what needs action:

$since = (Get-Date).AddHours(-24)
Get-WinEvent -FilterHashtable @{LogName='System'; Level=1,2; StartTime=$since} |
  Select-Object TimeCreated, Id, ProviderName, @{n='Msg';e={$_.Message.Substring(0,[Math]::Min(120,$_.Message.Length))}} |
  Format-Table -Wrap

Levels 1 and 2 are Critical and Error. If the volume is unmanageable, the log files themselves are oversized — cap them so they rotate instead of consuming the system drive:

wevtutil sl System /ms:209715200     # 200 MB cap
wevtutil sl Application /ms:209715200

System Drive Housekeeping

The four things that quietly consume a Windows Server system drive are component store growth, CBS logs, Windows Update cache, and IIS logs. Check them in that order:

Location	Typical growth	Safe action
C:\Windows\WinSxS	8-15 GB	DISM /Online /Cleanup-Image /StartComponentCleanup /ResetBase
C:\Windows\Logs\CBS	1-10 GB	Delete *.log, keep the folder
C:\Windows\SoftwareDistribution\Download	2-20 GB	Stop wuauserv, clear, restart
C:\inetpub\logs\LogFiles	Unbounded	Enable log rollover and scheduled purge
Pagefile	RAM-sized	Move to a data volume if one exists

# IIS: cap total log size and compress old files
Set-WebConfigurationProperty -PSPath IIS:\ -Filter "system.applicationHost/sites/siteDefaults/logFile" -Name logFileRollover -Value true
Set-WebConfigurationProperty -PSPath IIS:\ -Filter "system.applicationHost/sites/siteDefaults/logFile" -Name period -Value Daily
Set-WebConfigurationProperty -PSPath IIS:\ -Filter "system.applicationHost/sites/siteDefaults/logFile" -Name truncateSize -Value 10485760

Never delete WinSxS contents manually — you will break servicing updates permanently. DISM /StartComponentCleanup is the only supported reduction path. If your system volume is simply too small, the free-space thresholds most hosts expect are listed in our Windows VPS comparison table.

Remote Administration Without RDP

Every command above works over WinRM, which means you can run the whole checklist from a local PowerShell session without opening a desktop:

Enter-PSSession -ComputerName vps.example.com -Credential (Get-Credential)
# or, for a bulk run:
Invoke-Command -ComputerName vps.example.com -FilePath .\daily-health.ps1

Where to Start

If you are choosing a host that gives you the full administrative surface these tasks require — no locked-down control panel, no restricted service management — InterServer Windows VPS provides licensed Windows Server with admin rights and flat renewal pricing; code TRYINTERSERVER makes the first month $0.01. For workloads needing NVMe and hourly billing, compare Vultr.

Password and Credential Hygiene on a Single-Admin VPS

Most Windows VPS breaches do not start with an exploit. They start with a reused local administrator password exposed through RDP. Two changes close that gap without disrupting your workflow. First, rename or disable the built-in Administrator account and create a named admin account instead, because the built-in SID is the one every brute-force tool targets:

# disable the built-in Administrator (SID ends -500) and use a named admin
$admin = Get-LocalUser | Where-Object { $_.SID.Value -like '*-500' }
Disable-LocalUser -Name $admin.Name

New-LocalUser -Name 'svcadmin' -Password (Read-Host -AsSecureString) -PasswordNeverExpires $false
Add-LocalGroupMember -Group 'Administrators' -Member 'svcadmin'

Second, enforce an account lockout policy. RDP has no application-layer rate limiting by default, so lockout thresholds are your only automatic defence against password spraying. Ten invalid attempts with a fifteen-minute observation window stops automated attacks while leaving room for human typing errors:

net accounts /lockoutthreshold:10 /lockoutduration:15 /lockoutwindow:15

Be careful to exclude at least one admin account from lockout, or you can lock yourself out of the only route into the machine. The complete hardening order, including NLA and certificate-based RDP, is set out in our RDP hardening order guide — follow it in sequence rather than applying individual settings at random.