Windows Server First-Hour Checklist: 12 Steps to a Secure, Stable VPS

The first hour after you receive RDP credentials for a new Windows Server VPS determines whether that box stays healthy for years or gets compromised in weeks. This checklist covers the twelve steps that matter most, in the order you should do them. Most take under a minute each; together they turn a stock OS image into a server you can safely put on the public internet. If you are still choosing a host, Windows VPS hosting plans typically ship with Server 2022 or 2025 templates, but the steps below apply to any edition.

1. Connect, then verify what you actually got

Log in over RDP and confirm the OS version, edition, and resource allocation match what you paid for. Run this in an elevated PowerShell prompt:

winver
systeminfo | Select-String "OS Name","OS Version","Total Physical Memory"
Get-WmiObject Win32_Processor | Select-Object Name, NumberOfCores, NumberOfLogicalProcessors

If the core count, RAM, or edition differs from your invoice, open a ticket with the provider before you configure anything else. It is far easier to fix a mis-sized VPS on day one than after you have installed a database on it.

2. Change the Administrator password and create a daily account

Hosting providers often set a temporary password that is the same across many deployments, or that appears in your welcome email. Change it immediately:

net user Administrator "New-Str0ng-P@ssw0rd!"
net user Administrator /logonpasswordchg:yes

Then create a separate account for your day-to-day work so the built-in Administrator is not used for routine logins (its name is a well-known attack target):

net user ops "Another-Strong-P@ssw0rd" /add
net localgroup Administrators ops /add

Use the new account for everything from here on. A 14-character passphrase with mixed character classes takes roughly 200 billion years to brute-force at current GPU speeds, while a reused provider default can fall in minutes.

3. Install updates twice

Stock images are often weeks or months behind on patches. Run Windows Update, reboot, then run it again — the second pass usually finds updates that depend on the first reboot. On Server 2022 and 2025 you can drive this from PowerShell:

Install-Module PSWindowsUpdate -Force -Scope CurrentUser
Get-WUInstall -MicrosoftUpdate -AcceptAll -AutoReboot

Do not skip the reboot-and-rescan cycle. A server that boots fully patched has dramatically fewer exposure windows, and you will avoid the awkward position of applying a critical cumulative update while troubleshooting an unrelated issue later.

4. Enable the firewall and confirm your RDP posture

Windows Firewall is on by default on Server editions, but confirm it is actually running and that the RDP rule is scoped as narrowly as your provider allows:

Get-NetFirewallProfile | Select-Object Name, Enabled
Get-NetFirewallRule -DisplayGroup "Remote Desktop" | Select-Object DisplayName, Enabled, Action

If your host offers a control-panel firewall, block inbound RDP (TCP 3389) there and reach the server through a VPN or a jump host instead. At minimum, enforce Network Level Authentication (it is default on recent builds) and set an account lockout policy so brute-force tools cannot hammer the login screen indefinitely:

net accounts /lockoutthreshold:5 /lockoutduration:15 /lockoutwindow:15

5. Fix time sync and review what is listening

Kerberos authentication fails when the clock drifts more than five minutes, and certificate validation gets flaky. Point W32Time at a reliable NTP source and verify sync:

w32tm /config /manualpeerlist:"time.windows.com" /syncfromflags:manual /reliable:yes /update
w32tm /resync
w32tm /query /status

Then see exactly what is exposed to the network:

netstat -ano | findstr LISTENING

Every listening port needs a justification. On a fresh VPS you should typically see 135 (RPC), 445 (SMB), 3389 (RDP), and maybe 5985/5986 (WinRM). Anything else — especially a database port like 1433 or 3306 — should be closed until you explicitly need it.

6. Set up backup before you configure anything else

Configure wbadmin or your provider’s snapshot feature now, while the system is still clean. A bare-bones backup of a fresh install is small and fast; doing it after you install IIS, SQL Server, and your application means the first real backup happens at the worst possible time. A minimal bare-metal backup to a second disk:

wbadmin start backup -backupTarget:E: -include:C: -allCritical -quiet

Test the restore procedure in the first week, not the first emergency. A backup that has never been restored is a rumor.

7. Take a snapshot, then document

Once the system is patched, hardened, and backed up, take a clean snapshot through your provider’s panel. Label it baseline-post-hardening. If a later change breaks something, you can roll back to a known-good state in minutes instead of rebuilding.

Finally, write down the essentials in your password manager: the public IP, the daily account name, the RDP port if you changed it, the snapshot label, and the provider’s support URL. That single note saves a panicked hour at 2 a.m. during an outage.

The first-hour checklist at a glance

Step	Command or action	Why it matters
Verify specs	systeminfo	Catches mis-sized VPS before it matters
Change passwords	net user Administrator ...	Kills shared/known default credentials
Daily account	net localgroup Administrators	Reduces exposure of the well-known admin name
Patch twice	Get-WUInstall + reboot	Closes known CVEs before first exposure
Firewall check	Get-NetFirewallProfile	Confirms only intended ports are open
Lockout policy	net accounts /lockoutthreshold:5	Stops brute-force RDP attacks
Time sync	w32tm /config	Keeps Kerberos and certificates valid
Port review	netstat -ano	Finds services exposed unintentionally
Backup	wbadmin start backup	Ensures recoverability before real data exists
Snapshot	Provider panel	Gives a known-good rollback point

That is the whole first hour: verify, harden, patch, back up, snapshot, document. Servers that get these twelve steps on day one rarely make the rounds in breach reports. If you want to see how the same discipline applies after you add IIS, SQL Server, or a game server, the rest of this blog walks through each role in detail — and our Windows VPS service includes templates that already follow this baseline.