How to Add Users and Manage Profiles on a Windows VPS

Giving someone access to your Windows VPS is not about creating a “profile” in the consumer sense — it is about creating a local user account and making sure that account can log in over Remote Desktop with the right permissions. This guide covers the PowerShell commands to create users, the groups that control what they can do, and what to do when a profile misbehaves (temp profiles and “user cannot connect” are the two classics). If you are comparing plans while you read, the Windows VPS provider comparison shows how many users and sessions each plan realistically supports.

Local Users vs. Microsoft Accounts vs. Profiles

Three terms get mixed up constantly, so let us separate them:

• Local user account — the credential that lets someone sign in to the server (name + password stored on that machine). This is what you create on a VPS.
• Microsoft account — an online identity (e.g. a personal @outlook.com login). Not needed on Windows Server and generally not supported for server logins.
• User profile — the folder (C:\Users\Username) and registry hive (HKEY_USERS) that store a user’s settings, desktop, and documents. It is created automatically on that user’s first login.

On a Windows VPS you always create local accounts. The profile takes care of itself the first time the user signs in — unless you run into the corruption issues covered at the end.

Step 1: Create the User Account

Open an elevated PowerShell (right-click PowerShell > Run as administrator) and run:

$pass = ConvertTo-SecureString 'Str0ng-Passw0rd-2026!' -AsPlainText -Force
New-LocalUser -Name 'dev1' -Password $pass -FullName 'Developer One' -Description 'Web dev account' -AccountNeverExpires

Notes on the switches:

• -AccountNeverExpires prevents the “password expired” lockout surprise; combine it with a rotation policy instead.
• -PasswordNeverExpires is a separate flag — only set it if you truly want a permanent password.
• For service accounts (agents, scheduled tasks), add -UserMayNotChangePassword.

Step 2: Grant the Right Group Membership

Group membership is what actually grants power. The three groups that matter on a standalone VPS:

Group	What members can do	Use for
Administrators	Everything: install software, change system settings, manage other users	You, and only you
Remote Desktop Users	Log in over RDP, but with standard-user rights once inside	Every human who needs access
Users	Basic local logon and file access; cannot RDP by default	Service and batch accounts

A common mistake is adding a person to Administrators so they can RDP — that also gives them full control of the server. The correct pattern is Remote Desktop Users for access, Administrators only for people who genuinely administer:

Add-LocalGroupMember -Group 'Remote Desktop Users' -Member 'dev1'
# Only if they truly need admin rights:
Add-LocalGroupMember -Group 'Administrators' -Member 'dev1'
# Verify:
Get-LocalGroupMember -Group 'Remote Desktop Users'

Membership changes apply on the user’s next login — no reboot required. If the user is already connected, ask them to sign out and back in. For a deeper discussion of least-privilege design, read our guide to user accounts and least privilege on Windows VPS.

Step 3: Manage the Profile

The profile appears after the user’s first successful login. To inspect all profiles on the machine, open System Properties > Advanced > Settings (under User Profiles), or use:

Get-CimInstance Win32_UserProfile | Select-Object LocalPath, Loaded, Special

To copy a standard profile to new users (e.g. pre-configuring a default desktop), use the Copy To button in the User Profiles dialog and grant Everyone read permission on the copied folder — that is the classic “default profile” trick. Do not hand-edit profile folders while a user is logged in; you will corrupt them.

Step 4: Disable or Remove Users Cleanly

When someone leaves the project, disable the account rather than deleting it — you keep the audit trail and can restore access later without rebuilding the profile:

Disable-LocalUser -Name 'dev1'
# Permanent removal (also deletes the profile on next clean-up):
Remove-LocalUser -Name 'dev1'

After Remove-LocalUser, delete the leftover C:\Users\dev1 folder and its registry profile key only if you are certain nothing needs the data.

Two Profile Problems You Will Actually Hit

1. “User cannot connect” over RDP

Almost always a group membership issue: the account is not in Remote Desktop Users (or Administrators), or the connection is being blocked by the account lockout policy. Check with Get-LocalGroupMember -Group 'Remote Desktop Users' and confirm the user is not locked out (net user dev1 shows the account state).

2. User gets a “temporary profile” every login

Each login starts fresh with a TEMP profile and settings never persist. The cause is a broken registry reference. In regedit, navigate to:

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList

Find the SID matching the user (check Get-LocalUser dev1 | Select SID), and inspect its ProfileImagePath. If the value is wrong or the key ends in .bak, the profile is orphaned. Easiest reliable fix: back up the user’s data, delete the account and profile, and recreate the account. Renaming SID keys by hand works, but one typo produces a user who cannot log in at all.

Wrap-Up

User management on a Windows VPS is three commands and one rule: Remote Desktop Users for access, Administrators for control, profiles take care of themselves until they break. Keep a naming convention (dev-, ops-, svc-), never share passwords, and audit group membership quarterly. When you size the plan for multiple concurrent RDP users, remember that each session consumes RAM — check the specs and pricing comparison so your chosen plan has headroom for everyone.