{"id":238,"date":"2025-12-31T02:00:03","date_gmt":"2025-12-31T02:00:03","guid":{"rendered":"https:\/\/windows-vps.org\/blog\/?p=238"},"modified":"2026-08-13T22:37:13","modified_gmt":"2026-08-13T22:37:13","slug":"how-to-add-a-sec-user-to-your-windows-vps","status":"publish","type":"post","link":"https:\/\/windows-vps.org\/blog\/how-to-add-a-sec-user-to-your-windows-vps\/","title":{"rendered":"Local User Accounts on Windows Server: Limited Accounts, Password Policies, and RDP Access"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">Why Your Windows Server Should Not Run as Administrator<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Running everything under the built-in Administrator account is the single most common cause of avoidable Windows Server breaches. One compromised password gives an attacker full control, and every session on the box \u2014 interactive, service, or scheduled task \u2014 shares the same identity, so audit logs cannot tell actions apart. The fix is routine: create a limited account for daily work, keep the built-in Administrator renamed or disabled, and control exactly who can log on over RDP. This guide covers the GUI and PowerShell steps for local accounts on a standalone Windows Server VM.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What &#8220;Limited Account&#8221; Means on a Server<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Local accounts on a domain-joined or standalone server fall into groups: <strong>Administrators<\/strong> (full control), <strong>Users<\/strong> (normal daily work), and <strong>Remote Desktop Users<\/strong> (RDP logon rights, nothing else). A limited account is a member of Users plus Remote Desktop Users \u2014 it can run applications, manage files it owns, and log in remotely, but it cannot install software, change system settings, or read other users&#8217; profiles. That boundary is what contains the damage when the account is compromised.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Creating a Local User with the GUI<\/h2>\n\n\n\n<ul class=\"wp-block-list\"><li>Open <strong>Computer Management<\/strong> \u2192 <strong>Local Users and Groups<\/strong> \u2192 <strong>Users<\/strong>.<\/li><li>Right-click \u2192 <strong>New User<\/strong>, enter the username and a strong password (12+ characters, mixed classes).<\/li><li>Leave &#8220;User must change password at next logon&#8221; checked for humans; uncheck it for service or automation accounts.<\/li><li>Right-click the new user \u2192 <strong>Properties<\/strong> \u2192 <strong>Member Of<\/strong> \u2192 <strong>Add<\/strong>, and add <strong>Remote Desktop Users<\/strong>.<\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Creating a Local User with PowerShell<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">PowerShell is faster and scriptable, which matters when you provision servers repeatedly:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>$pass = ConvertTo-SecureString 'Str0ng-Passw0rd-2026!' -AsPlainText -Force\nNew-LocalUser -Name 'appdeploy' -Password $pass -FullName 'Deploy Account' -Description 'Daily deployment account'\nAdd-LocalGroupMember -Group 'Remote Desktop Users' -Member 'appdeploy'\nAdd-LocalGroupMember -Group 'Users' -Member 'appdeploy'<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Verify with <code>Get-LocalGroupMember -Group 'Remote Desktop Users'<\/code>. Only members of Administrators and Remote Desktop Users can log on via RDP by default, so leaving a user out of both groups means they cannot connect remotely at all \u2014 a useful property for service accounts.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Password and Lockout Policy<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Open <code>secpol.msc<\/code> \u2192 <strong>Account Policies<\/strong> and set baseline values: minimum password length 12, complexity enabled, account lockout threshold 5, lockout duration 15 minutes. The lockout threshold matters most on an internet-facing VPS: it turns unlimited RDP brute-force attempts into five tries per 15 minutes, which stops the vast majority of automated attacks before they ever test a password list.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Service Accounts: Never Reuse Your Daily Login<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Applications that run as Windows services \u2014 IIS app pools, SQL Server, backup agents \u2014 should each get a dedicated local account with only the permissions that service needs, and &#8220;Log on as a service&#8221; granted via <code>secpol.msc<\/code> \u2192 <strong>User Rights Assignment<\/strong>. If a service runs as your daily user, any compromise of the service is a compromise of your interactive account. Separate identities also mean Event Viewer shows which service failed, instead of a wall of identical entries.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Auditing Who Logs In<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">With distinct accounts, auditing becomes useful. Check <strong>Event Viewer<\/strong> \u2192 <strong>Windows Logs<\/strong> \u2192 <strong>Security<\/strong> for event IDs 4624 (successful logon) and 4625 (failed logon), or query them with PowerShell: <code>Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625} -MaxEvents 20<\/code>. A burst of 4625 events from a single source IP is the signature of a brute-force attempt; lockout policy plus a firewall rule that blocks the offending IP, as covered in our RDP hardening guide, closes that loop. Blocking at the network edge is easier when the host provides a native IPv4 firewall \u2014 another detail tracked in <a href=\"https:\/\/windows-vps.org\/#providers\">our Windows VPS comparison table<\/a>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A naming convention makes accounts self-documenting: <code>u-<\/code> for human users (<code>u-jdoe<\/code>), <code>svc-<\/code> for service accounts (<code>svc-iis-pool1<\/code>), and <code>adm-<\/code> for break-glass administrators. When an alert fires on an account name, the prefix tells you immediately what kind of identity was involved and which runbook to open. Record each account&#8217;s purpose in its Description field \u2014 it costs ten seconds at creation and saves hours of archaeology when someone inherits the server a year later. The same convention should extend to RDP: a limited account that only needs application access should not be a member of Administrators just because it is convenient.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Keep the Built-In Administrator Out of Reach<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Rename the built-in Administrator account (<code>secpol.msc<\/code> \u2192 <strong>Local Policies<\/strong> \u2192 <strong>Security Options<\/strong> \u2192 &#8220;Accounts: Rename administrator account&#8221;) so attackers cannot assume the default name, and disable it if you have another account in the Administrators group. If you ever lock yourself out, the provider&#8217;s out-of-band console is the escape hatch \u2014 which is one reason <a href=\"https:\/\/windows-vps.org\/#providers\">our Windows VPS comparison table<\/a> notes which hosts include console access with every plan. On a fresh server, pair this user setup with our guide to securing RDP before you expose the box to the internet.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Need a Windows Server VM where you control local accounts from the first boot? <a href=\"https:\/\/vultr.com\/?ref=9804308-9J\" target=\"_blank\" rel=\"noreferrer noopener sponsored\">Deploy a Windows Server instance on Vultr<\/a> and use its browser-based console to configure users and policies before you ever open RDP to the internet.<\/p>\n\n","protected":false},"excerpt":{"rendered":"<p>If you&#8217;re managing a Windows VPS, you might find the need to add a secondary user for various reasons, such as delegating tasks or improving security. Knowing how to add a sec user to your Windows VPS can enhance your server&#8217;s functionality and security. For more detailed information and resources, check out\u00a0Windows VPS.<\/p>\n","protected":false},"author":1,"featured_media":239,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"iawp_total_views":1,"footnotes":""},"categories":[5],"tags":[],"class_list":["post-238","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-tutorials-guides"],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v26.1 (Yoast SEO v26.1) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Local User Accounts on Windows Server: Limited Accounts, Password Policies, and RDP Access - Windows VPS Blog<\/title>\n<meta name=\"description\" content=\"If you&#039;re managing a Windows VPS, you might find the need to add a secondary user for various reasons, such as delegating tasks or improving security. Knowing how to add a sec user to your Windows VPS can enhance your server&#039;s functionality and security. For more detailed information and resources, check out\u00a0Windows VPS.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/windows-vps.org\/blog\/how-to-add-a-sec-user-to-your-windows-vps\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Local User Accounts on Windows Server: Limited Accounts, Password Policies, and RDP Access\" \/>\n<meta property=\"og:description\" content=\"Local User Accounts on Windows Server: Limited Accounts, Password Policies, and RDP Access\" \/>\n<meta property=\"og:url\" content=\"https:\/\/windows-vps.org\/blog\/how-to-add-a-sec-user-to-your-windows-vps\/\" \/>\n<meta property=\"og:site_name\" content=\"Windows VPS Blog\" \/>\n<meta property=\"article:published_time\" content=\"2025-12-31T02:00:03+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-08-13T22:37:13+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/windows-vps.org\/blog\/wp-content\/uploads\/2025\/12\/7711-1.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"640\" \/>\n\t<meta property=\"og:image:height\" content=\"427\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"windows-vps\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"windows-vps\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/windows-vps.org\/blog\/how-to-add-a-sec-user-to-your-windows-vps\/\",\"url\":\"https:\/\/windows-vps.org\/blog\/how-to-add-a-sec-user-to-your-windows-vps\/\",\"name\":\"Local User Accounts on Windows Server: Limited Accounts, Password Policies, and RDP Access - Windows VPS Blog\",\"isPartOf\":{\"@id\":\"https:\/\/windows-vps.org\/blog\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/windows-vps.org\/blog\/how-to-add-a-sec-user-to-your-windows-vps\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/windows-vps.org\/blog\/how-to-add-a-sec-user-to-your-windows-vps\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/windows-vps.org\/blog\/wp-content\/uploads\/2025\/12\/7711-1.jpg\",\"datePublished\":\"2025-12-31T02:00:03+00:00\",\"dateModified\":\"2026-08-13T22:37:13+00:00\",\"author\":{\"@id\":\"https:\/\/windows-vps.org\/blog\/#\/schema\/person\/44caceed916d0db318aa08d5623a7a58\"},\"description\":\"If you're managing a Windows VPS, you might find the need to add a secondary user for various reasons, such as delegating tasks or improving security. Knowing how to add a sec user to your Windows VPS can enhance your server's functionality and security. For more detailed information and resources, check out\u00a0Windows VPS.\",\"breadcrumb\":{\"@id\":\"https:\/\/windows-vps.org\/blog\/how-to-add-a-sec-user-to-your-windows-vps\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/windows-vps.org\/blog\/how-to-add-a-sec-user-to-your-windows-vps\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/windows-vps.org\/blog\/how-to-add-a-sec-user-to-your-windows-vps\/#primaryimage\",\"url\":\"https:\/\/windows-vps.org\/blog\/wp-content\/uploads\/2025\/12\/7711-1.jpg\",\"contentUrl\":\"https:\/\/windows-vps.org\/blog\/wp-content\/uploads\/2025\/12\/7711-1.jpg\",\"width\":640,\"height\":427},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/windows-vps.org\/blog\/how-to-add-a-sec-user-to-your-windows-vps\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/windows-vps.org\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Local User Accounts on Windows Server: Limited Accounts, Password Policies, and RDP Access\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/windows-vps.org\/blog\/#website\",\"url\":\"https:\/\/windows-vps.org\/blog\/\",\"name\":\"Windows VPS Blog\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/windows-vps.org\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/windows-vps.org\/blog\/#\/schema\/person\/44caceed916d0db318aa08d5623a7a58\",\"name\":\"windows-vps\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/windows-vps.org\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/3f2573db5afcd1a6ab9abcc5d48fc8e42584bc87ab9d98cc156e5b2097766dd9?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/3f2573db5afcd1a6ab9abcc5d48fc8e42584bc87ab9d98cc156e5b2097766dd9?s=96&d=mm&r=g\",\"caption\":\"windows-vps\"},\"sameAs\":[\"https:\/\/windows-vps.org\/blog\"],\"url\":\"https:\/\/windows-vps.org\/blog\/author\/myxiechengxuan\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Local User Accounts on Windows Server: Limited Accounts, Password Policies, and RDP Access - Windows VPS Blog","description":"If you're managing a Windows VPS, you might find the need to add a secondary user for various reasons, such as delegating tasks or improving security. Knowing how to add a sec user to your Windows VPS can enhance your server's functionality and security. For more detailed information and resources, check out\u00a0Windows VPS.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/windows-vps.org\/blog\/how-to-add-a-sec-user-to-your-windows-vps\/","og_locale":"en_US","og_type":"article","og_title":"Local User Accounts on Windows Server: Limited Accounts, Password Policies, and RDP Access","og_description":"Local User Accounts on Windows Server: Limited Accounts, Password Policies, and RDP Access","og_url":"https:\/\/windows-vps.org\/blog\/how-to-add-a-sec-user-to-your-windows-vps\/","og_site_name":"Windows VPS Blog","article_published_time":"2025-12-31T02:00:03+00:00","article_modified_time":"2026-08-13T22:37:13+00:00","og_image":[{"width":640,"height":427,"url":"https:\/\/windows-vps.org\/blog\/wp-content\/uploads\/2025\/12\/7711-1.jpg","type":"image\/jpeg"}],"author":"windows-vps","twitter_card":"summary_large_image","twitter_misc":{"Written by":"windows-vps","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/windows-vps.org\/blog\/how-to-add-a-sec-user-to-your-windows-vps\/","url":"https:\/\/windows-vps.org\/blog\/how-to-add-a-sec-user-to-your-windows-vps\/","name":"Local User Accounts on Windows Server: Limited Accounts, Password Policies, and RDP Access - Windows VPS Blog","isPartOf":{"@id":"https:\/\/windows-vps.org\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/windows-vps.org\/blog\/how-to-add-a-sec-user-to-your-windows-vps\/#primaryimage"},"image":{"@id":"https:\/\/windows-vps.org\/blog\/how-to-add-a-sec-user-to-your-windows-vps\/#primaryimage"},"thumbnailUrl":"https:\/\/windows-vps.org\/blog\/wp-content\/uploads\/2025\/12\/7711-1.jpg","datePublished":"2025-12-31T02:00:03+00:00","dateModified":"2026-08-13T22:37:13+00:00","author":{"@id":"https:\/\/windows-vps.org\/blog\/#\/schema\/person\/44caceed916d0db318aa08d5623a7a58"},"description":"If you're managing a Windows VPS, you might find the need to add a secondary user for various reasons, such as delegating tasks or improving security. Knowing how to add a sec user to your Windows VPS can enhance your server's functionality and security. For more detailed information and resources, check out\u00a0Windows VPS.","breadcrumb":{"@id":"https:\/\/windows-vps.org\/blog\/how-to-add-a-sec-user-to-your-windows-vps\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/windows-vps.org\/blog\/how-to-add-a-sec-user-to-your-windows-vps\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/windows-vps.org\/blog\/how-to-add-a-sec-user-to-your-windows-vps\/#primaryimage","url":"https:\/\/windows-vps.org\/blog\/wp-content\/uploads\/2025\/12\/7711-1.jpg","contentUrl":"https:\/\/windows-vps.org\/blog\/wp-content\/uploads\/2025\/12\/7711-1.jpg","width":640,"height":427},{"@type":"BreadcrumbList","@id":"https:\/\/windows-vps.org\/blog\/how-to-add-a-sec-user-to-your-windows-vps\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/windows-vps.org\/blog\/"},{"@type":"ListItem","position":2,"name":"Local User Accounts on Windows Server: Limited Accounts, Password Policies, and RDP Access"}]},{"@type":"WebSite","@id":"https:\/\/windows-vps.org\/blog\/#website","url":"https:\/\/windows-vps.org\/blog\/","name":"Windows VPS Blog","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/windows-vps.org\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/windows-vps.org\/blog\/#\/schema\/person\/44caceed916d0db318aa08d5623a7a58","name":"windows-vps","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/windows-vps.org\/blog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/3f2573db5afcd1a6ab9abcc5d48fc8e42584bc87ab9d98cc156e5b2097766dd9?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/3f2573db5afcd1a6ab9abcc5d48fc8e42584bc87ab9d98cc156e5b2097766dd9?s=96&d=mm&r=g","caption":"windows-vps"},"sameAs":["https:\/\/windows-vps.org\/blog"],"url":"https:\/\/windows-vps.org\/blog\/author\/myxiechengxuan\/"}]}},"_links":{"self":[{"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/posts\/238","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/comments?post=238"}],"version-history":[{"count":5,"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/posts\/238\/revisions"}],"predecessor-version":[{"id":617,"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/posts\/238\/revisions\/617"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/media\/239"}],"wp:attachment":[{"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/media?parent=238"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/categories?post=238"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/windows-vps.org\/blog\/wp-json\/wp\/v2\/tags?post=238"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}