How to Use a Windows VPS: The First 30 Minutes After You Log In

You just got the welcome email from your hosting provider: an IP address, an administrator password, and a Windows Server that is now yours to break. The first thirty minutes after you log in decide whether that server stays boring and reliable or becomes a support ticket. This checklist covers the exact order of operations: password change, updates, firewall, RDP hardening, and a non-admin account for daily work. Skip ahead to the Windows VPS plan comparison if you have not picked a provider yet — resource limits matter for everything below.

Minutes 0–5: First Login and Password Change

Connect with Remote Desktop (Win+R, mstsc, enter the IP) and log in as .\Administrator with the temporary password. Inside the session, press Ctrl+Alt+End and change the password immediately. Then create a second administrator account so you are never one lockout away from losing access — the built-in Administrator account is the first target of every brute-force scan:

# Run in an elevated PowerShell on the VPS
$user = 'ops-admin'
$pass = ConvertTo-SecureString 'A-Long-Phrase-2026!x' -AsPlainText -Force
New-LocalUser -Name $user -Password $pass -FullName 'Ops Admin' -AccountNeverExpires
Add-LocalGroupMember -Group 'Administrators' -Member $user
Add-LocalGroupMember -Group 'Remote Desktop Users' -Member $user

Test logging in as ops-admin before you do anything else. If that works, you can even disable the default Administrator account later with Disable-LocalUser -Name Administrator once you are certain your new account works.

Minutes 5–10: Windows Update

VPS images are often weeks behind on patches. Install everything now while the server is idle:

# Windows Server 2022/2025 (or run sconfig and pick option 6)
Install-Module PSWindowsUpdate -Force -Scope CurrentUser
Get-WUInstall -MicrosoftUpdate -AcceptAll -AutoReboot

If you prefer the GUI, open Settings > Windows Update and click Check for updates. Reboot when prompted, then log back in. Do not move on until the server reports fully up to date — a vulnerable base image undermines every hardening step that follows.

Minutes 10–15: Firewall and Network Profile

Windows Firewall is on by default and that is exactly what you want. Verify it, and make sure the network profile is Public rather than Domain/Private so the most restrictive rules apply:

Get-NetFirewallProfile | Select-Object Name, Enabled
Get-NetConnectionProfile | Select-Object InterfaceAlias, NetworkCategory
# If the profile shows Private, switch it:
Set-NetConnectionProfile -InterfaceAlias 'Ethernet' -NetworkCategory Public

Confirm that only the services you actually need are listening. Get-NetTCPConnection -State Listen shows open ports; you should see 3389 (RDP) and little else on a fresh server. Anything unexpected — odd ports, unknown processes — investigate before continuing.

Minutes 15–20: RDP Hardening

This is the highest-value part of the checklist. RDP exposed on the default port gets hammered by bots within hours. Do these four things:

• Force Network Level Authentication (NLA): run SystemPropertiesRemote and tick Allow connections only from computers running Remote Desktop with NLA.
• Set an account lockout policy so brute-force attempts lock the account instead of guessing forever: net accounts /lockoutthreshold:5 /lockoutduration:30 /lockoutwindow:30.
• Restrict who can log in over RDP: only Administrators and the Remote Desktop Users group. Remove any default users you do not recognize.
• Change the RDP port (optional): edit HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp, set PortNumber (decimal) to something like 3391, then add a matching firewall rule. This is security by obscurity, but it eliminates 99% of automated scan noise.

Setting	Where	Recommended value
NLA	SystemPropertiesRemote	Enabled
Lockout threshold	net accounts	5 attempts
Lockout duration	net accounts	30 minutes
RDP port	Registry RDP-Tcp	3389 or custom
Firewall rule	Windows Defender Firewall	Inbound allow on RDP port only

Minutes 20–25: Create a Daily-Use Standard Account

Do not run your day-to-day work as Administrator. Create a standard user for installing nothing, browsing, and routine tasks. On a Windows Server you typically do this with PowerShell rather than the Consumer-style “Add family member” flow:

$user = 'daily'
$pass = ConvertTo-SecureString 'Another-Long-Pass!42' -AsPlainText -Force
New-LocalUser -Name $user -Password $pass -AccountNeverExpires
Add-LocalGroupMember -Group 'Remote Desktop Users' -Member $user
# NOT added to Administrators — that is the point.

If a task needs elevation, right-click PowerShell and Run as administrator, or use runas. Least-privilege accounts contain the damage when credentials leak; for a fuller breakdown see our guide to Windows VPS user accounts and least privilege.

Minutes 25–30: Backups and Housekeeping

Finally, set the server’s name and time zone (a wrong time zone wrecks log correlation and scheduled tasks), then enable a basic backup so your first mistake is recoverable. On Windows Server, the built-in tool is free:

Install-WindowsFeature Windows-Server-Backup
wbadmin enable backup -addtarget:E: -schedule:02:00 -include:C: -quiet

Point the backup at a separate virtual disk if your provider lets you attach one — never back up to the same drive you are protecting.

The 30-Minute Checklist, Summarized

Time	Task	Command / Tool
0–5	Change temp password, create second admin	Ctrl+Alt+End; New-LocalUser
5–10	Install all updates	sconfig / Get-WUInstall
10–15	Verify firewall, set Public profile	Get-NetFirewallProfile
15–20	NLA, lockout policy, restrict RDP users	SystemPropertiesRemote; net accounts
20–25	Create standard daily account	New-LocalUser
25–30	Hostname, time zone, backup job	wbadmin enable backup

Thirty minutes of setup saves you from a month of incident response. If your current plan does not have the RAM or disk to run updates and backups comfortably, check the Windows VPS providers list and compare specs before you commit to a long billing cycle.