How to Use a Windows VPS: The First 30 Minutes After You Log In

A fresh Windows Server VPS arrives in a state that is functional but not safe: it has a default administrator name, an open RDP port, possibly no pending updates applied, and a firewall profile that assumes a friendly corporate LAN. The first half hour is the cheapest security you will ever buy, and skipping it costs far more to fix later.

This is a prioritised order, not an exhaustive hardening guide. Work top to bottom; everything below the halfway mark can wait for the same evening, but the first four items should happen before the box is exposed to real traffic.

Minutes 0–5: confirm what you logged into

Log in through the provider’s console (not RDP) for the first session if possible, so a firewall mistake cannot lock you out. Then confirm the basics: hostname, Get-ComputerInfo | Select WindowsProductName, WindowsVersion, OsArchitecture, and the actual activation state. You want to know you are on Server 2022 or 2025, Standard or Datacenter, and that the licence is activated before you invest an hour configuring it.

Get-ComputerInfo | Select-Object WindowsProductName, WindowsVersion, OsBuildNumber
slmgr /xpr
Get-Disk | Format-Table Number, FriendlyName, Size, PartitionStyle
Get-Volume | Where-Object DriveLetter | Format-Table DriveLetter, FileSystem, SizeRemaining, Size

Also note the private and public IP, and whether the provider put you behind NAT. If the public IP is not on the adapter, something else is doing the translation and that changes how firewall rules behave.

Minutes 5–10: identity and patch level

Rename the machine only if it is joining a domain or you need a predictable hostname; a standalone box is fine with the provider’s default as long as you record it. Then check patch state. A new image is often weeks or months behind, and the cumulative update is a multi-hundred-megabyte download that you do not want starting during your first deploy.

Run Get-WindowsUpdate if the PSWindowsUpdate module is available, or use Get-HotFix to see the last installed rollup. Install everything, reboot, then confirm the build number moved. If you plan to join a domain, do it before you start installing applications — renaming or re-joining after SQL Server is installed is avoidable pain.

Minutes 10–15: firewall profiles and RDP hardening

Windows ships with three firewall profiles and, on a VPS, all three are usually set to block except what the image opened. Check them explicitly, because a provider image may have quietly disabled the public profile.

Get-NetFirewallProfile | Select Name, Enabled, DefaultInboundAction, DefaultOutboundAction
Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled True -DefaultInboundAction Block
New-NetFirewallRule -DisplayName "RDP from office" -Direction Inbound -Protocol TCP -LocalPort 3389 -RemoteAddress 203.0.113.10 -Action Allow

Restricting RDP to a known source IP is the single highest-value change you can make. If you cannot do that because you work from changing addresses, at minimum enable Network Level Authentication, set an account lockout policy, and change the default administrator username rather than only moving the port. Port-shifting alone buys you almost nothing against modern scanners. For a wider look at this, our guide to securing RDP on a Windows VPS covers TLS certificate binding and gateway options.

Enable NLA and lockout together, and test lockout on a non-admin account before relying on it:

• System Properties → Remote → “Allow connections only from computers running Remote Desktop with Network Level Authentication”.
• net accounts /lockoutthreshold:5 /lockoutduration:15 /lockoutwindow:15.
• Rename the built-in Administrator and create a named admin account for yourself.

Minutes 15–22: accounts, page file and disk layout

Create your own admin account, give the built-in Administrator a long random password and leave it disabled except for console break-glass. Local admin group membership should be short: your account plus nothing else. Audit it with Get-LocalGroupMember Administrators.

Page file placement matters more on a VPS than on a workstation. Leave the system-managed page file on C: unless C: is very small; putting it on a second data disk is fine, but never on a volume that is itself stored on slow network-backed storage. Sizing rule of thumb: system-managed, or 1.5× RAM up to 16 GB, then fixed at 16 GB for larger machines running SQL Server.

Check disk layout while you are here. Many budget plans ship a single C: volume, which means IIS logs, SQL data and the page file all compete. If a second disk exists, move logs and data onto it before deploying anything — moving them afterwards means downtime.

Minutes 22–27: time zone, NTP and hostname records

A VPS in another region will default to the provider’s time zone, and virtual clocks drift more than physical ones. Set the zone deliberately and point the time service at a reliable source.

Set-TimeZone -Id "UTC"
w32tm /config /manualpeerlist:"time.windows.com,0x9" /syncfromflags:manual /reliable:yes /update
Restart-Service w32time
w32tm /resync
w32tm /query /status

UTC is the right default for servers; convert in the application layer. A drifting clock breaks Kerberos, TLS and scheduled tasks in ways that look like unrelated bugs. Confirm the offset is under a second after resync.

Minutes 27–30: backup baseline and verification

Before you install anything, take a snapshot or trigger the provider’s first backup. That gives you a known-good return point that predates your configuration mistakes. Then verify the recovery path actually works — an untested backup is a hope, not a plan.

Close out with a short verification pass. Every one of these should return the value you set, not the default:

• Get-NetFirewallProfile shows all three profiles enabled and inbound blocked by default.
• Get-LocalGroupMember Administrators lists only the accounts you intended.
• w32tm /query /status reports a synced source and small offset.
• Get-HotFix shows an update installed today.
• slmgr /xpr reports the licence activated permanently.
• A second RDP session from your normal workstation succeeds, proving you did not lock yourself out.

Thirty minutes gets you from “rented server” to “defensible baseline”. The next step is usually installing the web stack; our walkthrough of installing IIS and .NET on a Windows VPS picks up exactly where this checklist ends.