Windows Server 2025 is Microsoft’s latest server operating system, offering improved performance, enhanced security features, and better integration with cloud services. Running it on a VPS gives you a full Windows environment in the cloud without the upfront hardware cost. This guide walks you through the entire setup process — from initial RDP access to server hardening — combining both the configuration-wizard approach and the PowerShell automation methods you need for efficient administration.
Step 1: Initial RDP Access
When your VPS provider provisions a Windows Server 2025 instance, they will send you the IP address and administrator credentials. Here is how to connect:
- Open Remote Desktop Connection (press Win + R, type
mstsc) - Enter the VPS IP address and click Connect
- Click “More Options” → “Connection Settings” → save the RDP file for future use
- Log in with the provided Administrator username and password
- Accept the certificate warning (it is self-signed for first connection)
- You will see the Server Manager dashboard — this is your command center for all configuration tasks
First action: Change the Administrator password immediately. Use Computer Management > Local Users and Groups or run:
net user Administrator "Your-Strong-P@ssword-2026!"Step 2: Server Manager Configuration
Server Manager opens automatically on first login. Use it to:
- Configure local server settings: Enable or disable IE Enhanced Security Configuration, set time zone, configure Windows Update
- Add roles and features: This is where you install IIS, .NET, and other server components
- Manage storage: Check available disk space and create additional volumes if needed
- View performance metrics: Monitor CPU, memory, and network usage from the Dashboard
- Change the computer name: Give your server a meaningful hostname
Rename the Server via PowerShell
Rename-Computer -NewName "WS2025-PROD-01" -RestartStep 3: Adding Roles and Features (IIS + .NET)
For most web hosting scenarios, you will need IIS (Internet Information Services) and the .NET runtime. You have two options: the Server Manager wizard or PowerShell.
Option A: Using Server Manager (GUI)
- In Server Manager, click Manage > Add Roles and Features
- Select Role-based or feature-based installation and choose your server
- Under Server Roles, check Web Server (IIS)
- Under Features, check .NET Framework 4.8 Features
- For IIS, add commonly needed role services:
- Common HTTP Features: Default Document, Directory Browsing, HTTP Errors, Static Content
- Health and Diagnostics: HTTP Logging, Request Monitor
- Performance: Static Content Compression, Dynamic Content Compression
- Security: Windows Authentication, URL Authorization, Request Filtering
- Application Development: ASP.NET 4.8, ISAPI Extensions, ISAPI Filters
- Click Install and wait for the process to complete
Option B: Using PowerShell (Faster, Repeatable)
# Install IIS with management tools
Install-WindowsFeature -Name Web-Server -IncludeManagementTools
# Install .NET Framework 4.8
Install-WindowsFeature -Name NET-Framework-45-Features
# Install .NET 8/9/10 Runtime
Invoke-WebRequest -Uri "https://dot.net/v1/dotnet-install.ps1" -OutFile dotnet-install.ps1
.\dotnet-install.ps1 -Channel 10.0 -Runtime aspnetcore
# Install other common roles
Install-WindowsFeature -Name DNS -IncludeManagementTools
Install-WindowsFeature -Name FS-FileServerTo verify IIS is working, open a browser on your VPS and navigate to http://localhost. You should see the default IIS welcome page.
Step 4: Configuring Windows Update
A freshly installed Windows Server 2025 will need updates. Configure update settings for a production server:
- Go to Settings > Windows Update
- Click Check for updates and install all available updates
- Set Advanced Options > Active Hours to avoid reboots during business hours
- For production servers, consider using Group Policy to schedule a maintenance window
Alternatively, configure updates via PowerShell:
# Set to download and install automatically at 2 AM
Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update" -Name "AUOptions" -Value 4
# Check for and install updates
Install-Module PSWindowsUpdate -Force
Get-WindowsUpdate -Install -AcceptAll -AutoRebootStep 5: Windows Firewall Configuration
Windows Defender Firewall with Advanced Security is enabled by default on Server 2025. Open only the ports your services need:
| Service | Default Port | Firewall Rule |
|---|---|---|
| RDP | 3389 (TCP) | Pre-enabled (inbound) |
| HTTP | 80 (TCP) | Add inbound rule for web traffic |
| HTTPS | 443 (TCP) | Add inbound rule for secure web traffic |
| FTP | 21 (TCP) | Add inbound rule (if using FTP) |
| SQL Server | 1433 (TCP) | Add inbound rule (if running SQL) |
To add rules via PowerShell:
# Allow HTTP and HTTPS
New-NetFirewallRule -DisplayName "HTTP (80)" -Direction Inbound -Protocol TCP -LocalPort 80 -Action Allow
New-NetFirewallRule -DisplayName "HTTPS (443)" -Direction Inbound -Protocol TCP -LocalPort 443 -Action Allow
# Allow SQL Server if needed
New-NetFirewallRule -DisplayName "SQL Server" -Direction Inbound -Protocol TCP -LocalPort 1433 -Action Allow
# Block everything else by default
Set-NetFirewallProfile -Profile Domain,Public,Private -DefaultInboundAction BlockTo add a rule via the GUI: Open Windows Defender Firewall > Advanced Settings > Inbound Rules > New Rule. Select Port, specify the port number, choose Allow the connection, and apply it to Domain, Private, and Public profiles.
Step 6: Security Hardening
A freshly provisioned server needs hardening before it goes into production. Apply these essential security measures:
- Change default Administrator password immediately and use a password manager for randomized passwords of 20+ characters
- Enable RDP Network Level Authentication (NLA): System Properties > Remote > “Allow connections only from computers running Remote Desktop with NLA”
- Set account lockout policy: 5 invalid attempts → 15-minute lockout via secpol.msc > Account Policies > Account Lockout Policy
- Enable audit logging:
auditpol /set /subcategory:"Logon" /success:enable /failure:enable - Install Windows Defender Antivirus: Ensure real-time protection is active via
Set-MpPreference -DisableRealtimeMonitoring $false - Enable auditing: Configure Advanced Audit Policy in Local Security Policy to track logon events, object access, and policy changes
- Create a non-admin user: Use a standard user account for daily administration tasks and elevate only when needed
Step 7: Post-Setup Best Practices
- Set up backup: Use Windows Server Backup or a third-party tool to schedule regular backups. Configure provider-level snapshots if available.
- Install monitoring tools: Performance Monitor, Resource Monitor, and optionally third-party tools like Zabbix or PRTG for proactive alerting.
- Configure automatic reboots: Schedule a weekly maintenance window via Task Scheduler to apply updates and restart if needed.
- Enable RDP UDP transport: RDP performs better over UDP than TCP on high-latency connections. Ensure UDP 3389 is open in the firewall.
Conclusion
Setting up Windows Server 2025 on a VPS is a smooth process when you follow the right steps. Start with RDP access and password changes, configure Server Manager, add IIS and .NET for web hosting, lock down Windows Update, fine-tune the firewall, and apply security hardening measures. Whether you prefer the Server Manager GUI for visual configuration or PowerShell for repeatable automation, a properly configured Windows Server 2025 VPS provides a rock-solid foundation for hosting applications, websites, and services. Compare Windows VPS plans on our comparison table to find providers that offer Windows Server 2025 with pre-configured templates.
