The first 30 minutes after you log into a fresh Windows VPS determine how much pain the next year brings. Provider templates ship with Remote Desktop enabled, the Administrator account set, and little else — updates pending, firewall defaults, and no hardening applied. This guide walks through the first-boot checklist: initial login, Windows updates, firewall configuration, RDP hardening, and admin account hygiene. Follow it in order and you will have a server that is stable, patched, and boring to attack.
First Login and the Forced Password Change
Connect with Remote Desktop (mstsc) using the IP address and credentials from your provider’s control panel — usually username Administrator and a generated password. Windows will force a password change on first login. Pick a long passphrase (16+ characters, memorable but not guessable) and store it in a password manager rather than a text file. If you skip this step, your server keeps the provider-generated password that may also be documented in forum posts.
The First-Boot Checklist
- Change the Administrator password (forced on first login) and store it safely.
- Install all pending Windows updates, reboot, and repeat until no updates remain.
- Rename the built-in Administrator account or disable it, and create a named admin account instead.
- Create a standard (non-admin) user for everyday work.
- Verify the Windows Firewall is on for all profiles and only needed ports are open.
- Confirm RDP access is limited to the Remote Desktop Users group.
- Set an account lockout policy (e.g., 5 attempts, 15-minute lockout) to blunt brute force.
- Schedule Windows Update reboots into a maintenance window so you are not surprised.
- Turn on basic auditing so the Security log records logon failures.
- Take a snapshot or backup once the server is clean and fully patched.
Windows Updates: Do Them Early, Schedule the Reboots
Run updates immediately after first login — a fresh template is often months behind. On the full desktop experience, use Settings → Windows Update and click Check for updates repeatedly until the server reports fully up to date. On Server Core, use sconfig or the PSWindowsUpdate module. The key difference from a desktop OS: Windows Server will not force a reboot on you, but it will also keep nagging until you schedule one. Set a maintenance window that matches your lowest traffic hours and approve updates there, so a 2 a.m. production box does not restart itself mid-task.
Windows Firewall Basics
The Windows Firewall is on by default with all three profiles (Domain, Private, Public) active; on most VPS setups the interface lands in the Public or Domain profile. The rule is simple: allow only what you need. Typical inbound ports are 3389 (RDP), 80/443 (IIS), and 1433 (SQL Server) — nothing else. Add rules with the GUI or PowerShell:
New-NetFirewallRule -DisplayName "RDP from office" -Direction Inbound -Protocol TCP -LocalPort 3389 -RemoteAddress 203.0.113.0/24 -Action AllowRestricting RDP to a known source IP range is one of the highest-value firewall changes you can make, because it removes the port from the internet’s brute-force lottery entirely. Also remember that many providers run a second firewall in the control panel — check both layers when a port “will not open.”
RDP Hardening
Remote Desktop is the most attacked service on a Windows server, so harden it in this order:
- Keep NLA enabled (System Properties → Remote → Network Level Authentication) so credentials are verified before a session is created.
- Limit the Remote Desktop Users group to named admins only — never “everyone.”
- Set an account lockout policy via Local Security Policy or
net accountsto stall automated password guessing. - Disable or rename the default Administrator account once your named admin exists; a hidden target is harder to guess.
- Consider a Remote Desktop Gateway or VPN so port 3389 is not exposed directly to the internet at all.
Changing the RDP port number is sometimes recommended, but treat it as a minor deterrent, not a control — a port scan finds it in seconds. Source-IP allowlisting and NLA are the real defenses.
Admin Account Hygiene
Do not do daily work as Administrator. Create one named account in the Administrators group for elevated tasks and one standard user for routine browsing and file work, then log on with the standard user and elevate only when needed (right-click → Run as administrator, or Start-Process -Verb RunAs in PowerShell). This limits the blast radius if the everyday account is compromised, and it keeps the audit trail readable: logon events for the admin account are rare and therefore suspicious when they appear.
Checklist at a Glance
| Task | Priority | How |
|---|---|---|
| Change Administrator password | Critical | Forced on first login |
| Install all Windows updates | Critical | Windows Update / sconfig |
| Create named admin, disable default | High | Computer Management → Local Users and Groups |
| Verify firewall, restrict RDP source IP | High | Windows Firewall + provider panel |
| Limit Remote Desktop Users group | High | System Properties → Remote Desktop |
| Set account lockout policy | High | Local Security Policy / net accounts |
| Schedule update reboots | Medium | Group Policy / sconfig |
| Enable auditing | Medium | Local Security Policy |
| Take a clean snapshot | High | Provider control panel |
Before You Declare Victory
Once the checklist is done, take a snapshot so you have a known-good restore point, then install your workload — IIS, SQL Server, or whatever the server is for. If you would rather start from a provider that pre-hardens its images, compare the security features included in different Windows VPS plans. And when it is time to size the box, check which providers offer the specs your workload actually needs before you pay for capacity you will not use.
Starting fresh? Get a Windows VPS from Hostwinds and run this checklist on your first boot.
