A fresh Windows Server VPS is reachable over Remote Desktop from the whole internet — and Windows RDP servers are among the most scanned targets there are. Spend twenty minutes on these steps before installing anything else. Most apply equally to Windows Server 2019 and 2025.

1. Connect

From Windows: run mstsc, enter the server IP and log in as Administrator with the password from your welcome email. From macOS: use Microsoft’s Windows App from the App Store. See connecting to a Windows VPS with Remote Desktop.

2. Install all updates

Settings → Update & Security → Windows Update → Check for updates, or in PowerShell (as Administrator), using the built-in tool:

usoclient StartScan

Windows Update on a fresh server can take a while and need several reboots. Do it first; many attacks target unpatched systems. For scripted updates, see Windows Update with PowerShell.

Choose when updates install: Settings → Windows Update → Advanced options lets you set active hours so automatic restarts don’t hit your busy times.

3. Create your own admin account

Bots guess passwords for Administrator constantly. Create a personal admin and stop using the default account:

$pw = Read-Host -AsSecureString "Password"
New-LocalUser -Name "alice" -Password $pw -PasswordNeverExpires
Add-LocalGroupMember -Group "Administrators" -Member "alice"
Add-LocalGroupMember -Group "Remote Desktop Users" -Member "alice"

Log in as the new user over RDP to test, then disable or rename the built-in account:

Rename-LocalUser -Name "Administrator" -NewName "localroot"
# or
Disable-LocalUser -Name "Administrator"

4. Set an account lockout policy

Without lockout, an attacker can try passwords forever. Open Local Security Policy (secpol.msc) → Account Policies → Account Lockout Policy:

  • Account lockout threshold: 5 invalid attempts
  • Lockout duration: 30 minutes
  • Reset counter after: 30 minutes

Or from an elevated prompt:

net accounts /lockoutthreshold:5 /lockoutduration:30 /lockoutwindow:30

Note: the built-in Administrator account is exempt from lockout by default — another reason to disable it.

5. Secure Remote Desktop

  • Network Level Authentication must be on: System Properties → Remote → “Allow connections only from computers running Remote Desktop with Network Level Authentication”.
  • Change the RDP port to reduce automated attacks: how to change the RDP port.
  • Restrict by IP if you connect from fixed addresses, by editing the Remote Desktop firewall rule’s scope.
  • Block repeated failures automatically: RDP brute-force protection.

6. Review the firewall

Windows Defender Firewall is on by default. List what’s allowed in:

Get-NetFirewallRule -Direction Inbound -Enabled True | Select-Object DisplayName, Profile | Sort-Object DisplayName

Disable rules you don’t need (file sharing, for example). Open ports for your services explicitly — see Windows firewall with PowerShell.

7. Time zone and time sync

Get-TimeZone
Set-TimeZone -Id "UTC"            # or e.g. "China Standard Time", "Eastern Standard Time"
w32tm /query /status
w32tm /resync

Trading platforms and scheduled tasks depend on correct time.

8. Turn off IE Enhanced Security Configuration (if you browse)

Server Manager → Local Server → IE Enhanced Security Configuration → Off for Administrators. On Windows Server 2022, Microsoft Edge is included; ESC mainly affects legacy Internet Explorer mode. Avoid general browsing on a server anyway — download what you need and close the browser.

9. Check drivers (VirtIO)

KVM servers perform best with VirtIO network and storage drivers. Open Device Manager and confirm there are no yellow warning icons. If a device is missing a driver, install the signed virtio-win drivers. See Windows Device Manager.

10. Page file and memory

Leave the page file on “System managed” unless you have a reason to change it. On small-RAM servers, a page file prevents applications from crashing under memory pressure. Check memory use in Task Manager or Resource Monitor.

11. Microsoft Defender

Defender Antivirus is built in and enabled. Confirm with:

Get-MpComputerStatus | Select-Object AMServiceEnabled, AntivirusEnabled, RealTimeProtectionEnabled, AntivirusSignatureLastUpdated

For trading platforms or databases, add folder exclusions only where the vendor recommends them.

12. Backups

Windows Server Backup is an optional feature:

Install-WindowsFeature Windows-Server-Backup

Back up to a second disk or a network share on another server, or use a backup tool that uploads to object storage. At minimum, copy important data off the server regularly. See Windows Server Backup.

13. Licensing

Windows Server needs a valid license. On VPS.DO, Windows Server comes with a free 180-day evaluation; activate your own license before it expires. See Windows Server activation.

Verification checklist

  • All updates installed, server rebooted
  • Personal admin account created; built-in Administrator disabled or renamed
  • Account lockout policy active
  • NLA on; RDP port changed or restricted
  • Only necessary firewall rules enabled
  • Correct time zone, time synchronized
  • No missing drivers
  • Defender active with current signatures
  • Backup plan in place

Our Windows VPS plans run Windows Server on KVM, on plans with at least 50 GB of disk. For trading setups, see MT4/MT5 on a Windows VPS.

  • Windows Server
  • RDP
  • Security