For a development team that needs web hosting, a shared database, and remote desktop access from a single box, the classic stack is a Windows VPS running IIS, SQL Server, and RDP. It is also a stack where small configuration mistakes — an exposed SQL port, an unisolated application pool, a licensing misunderstanding — surface later as outages or compliance problems. This article covers the configuration decisions that matter, in the order you should make them.
Right-sizing the box
Dev workloads are more demanding than production hosting of the same app, because multiple people compile, run tests, and query databases at the same time. Plan for concurrency:
| Team size | Recommended specs | Rough monthly cost |
|---|---|---|
| 2–3 developers | 4 vCPU, 8 GB RAM, 160 GB NVMe | $50–$80 |
| 4–6 developers | 8 vCPU, 16 GB RAM, 320 GB NVMe | $100–$150 |
| 7–10 developers | 12 vCPU, 32 GB RAM, 500 GB NVMe | $180–$250 |
NVMe matters here: SQL Server I/O and build times both respond directly to storage latency. If you are still comparing offers, see the full specs and pricing on the main site before you commit.
Install and isolate IIS
Install IIS with the features a dev team actually uses, then isolate each developer’s site in its own application pool so one person’s crashing code cannot take down the staging site:
Install-WindowsFeature Web-Server, Web-WebSockets, Web-Asp-Net45, `
Web-Mgmt-Console, Web-Scripting-Tools -IncludeManagementTools
# one app pool per developer
New-WebAppPool -Name "dev.alice"
New-WebSite -Name "alice.dev" -Port 8081 -PhysicalPath "D:\Sites\alice" `
-ApplicationPool "dev.alice" -Force- Dynamic compression for API responses during debugging.
- Failed Request Tracing (FREB) on each dev site — the XML traces are invaluable when a developer reports an HTTP 500 with no log output.
- URL Rewrite module if anyone is testing clean URLs or a reverse proxy setup.
- Disable recycling during work hours on dev app pools so a restart does not drop in-flight sessions.
Every dev site should answer on HTTPS from day one, or you will spend time debugging mixed-content and cookie problems that only exist in development. A self-signed certificate silences nothing for browsers, so either issue real certificates with a Let’s Encrypt client (Win-ACME is the most common on Windows) or, for internal-only dev, add the dev hostnames to a small internal CA. Bind the certificate in IIS Manager and force an HTTPS redirect per site so nobody accidentally tests over plain HTTP.
SQL Server Developer Edition for the team
SQL Server Developer Edition is free for development and testing (full feature set, no production rights) — the correct choice for a dev box. Enable TCP/IP after install, then create one login and one sandbox database per developer:
-- per-developer login + sandbox database
CREATE LOGIN [dev_alice] WITH PASSWORD = 'StrongP@ssw0rd!';
CREATE DATABASE [DevDB_Alice];
USE [DevDB_Alice];
CREATE USER [dev_alice] FROM LOGIN [dev_alice];
EXEC sp_addrolemember 'db_owner', 'dev_alice';
-- cap the size so one runaway query can't fill the disk
ALTER DATABASE [DevDB_Alice] MODIFY FILE
(NAME = 'DevDB_Alice', MAXSIZE = 5120 MB);Do not expose port 1433 to the internet. Developers should reach SQL Server through the same VPN or RD Gateway you use for RDP, or through an SSH tunnel. A firewall rule scoped to your VPN subnet is the minimum:
New-NetFirewallRule -DisplayName "SQL-VPN" -Direction Inbound -LocalPort 1433 `
-Protocol TCP -RemoteAddress 10.8.0.0/24 -Action AllowOn the SQL side, also enable the dedicated administrator connection (DAC) and leave it local-only. If a runaway application wedges the instance, DAC is the way in when normal connections are refused — a small setting that has saved more than one dev environment.
RDP for more than two users: know the licensing reality
Windows Server permits two concurrent RDP sessions without extra licensing. Teams larger than that have three realistic paths:
- Remote Desktop Services with CALs (roughly $175 per user or $85 per device) — the licensed way to run 3+ simultaneous sessions.
- RDP wrappers that patch termsrv.dll — they work until an update breaks them, and they violate your licensing terms. Not recommended for anything you depend on.
- Browser-based development (VS Code Remote, code-server, web IDEs) — bypasses the session limit entirely and is often a better fit for developers who only need an editor.
Whichever route you take, restrict RDP itself to your VPN or office IP range. A RemoteAddress scoped firewall rule costs one line and removes most brute-force noise:
New-NetFirewallRule -DisplayName "RDP-VPN" -Direction Inbound -LocalPort 3389 `
-Protocol TCP -RemoteAddress 10.8.0.0/24 -Action AllowBackup and recovery for team data
- Daily VSS snapshots of the system and data drives via your provider’s control panel.
- Nightly SQL Server backups (Ola Hallengren’s maintenance scripts are the standard) to a separate volume.
- Git for all code — the VPS is a disposable compute layer; repositories are the real backup.
- Configuration-as-code: document IIS config, firewall rules, and SQL settings in the repo so a compromised or failed server can be rebuilt in under an hour.
The order of operations
Set up the firewall and VPN before installing SQL Server and IIS, so nothing is ever exposed even briefly. Create per-developer accounts before handing out access, and verify backups before the team starts storing real work on the box. A single Windows VPS running IIS, SQL Server, and RDP is a legitimate dev hub for small teams — the ones that fail are the ones that skipped isolation and access control. If you are still choosing a provider, compare Windows VPS plans side by side, or look at Contabo’s Windows VPS offers for high-RAM configurations at budget prices.
