Most Windows VPS setups aren’t joined to an Active Directory domain, so access is controlled with local users and groups. Getting this right matters: every RDP-enabled account is a door into the server. This guide shows how to manage accounts with both the GUI and PowerShell, and how to keep them secure.

Key built-in groups

Group Members can
Administrators Do everything on the server
Remote Desktop Users Log in over RDP (without admin rights)
Users Log in locally, run applications
Backup Operators Back up and restore files regardless of permissions
Event Log Readers Read event logs
Remote Management Users Use PowerShell Remoting/WinRM without being admin

Give each person their own account, with the least privilege they need. For example, a trader who only uses a trading platform should be in Remote Desktop Users, not Administrators.

Create a user (GUI)

  1. Open Computer Management (compmgmt.msc) → Local Users and Groups → Users.
  2. Right-click → New User, and set the username, a strong password, and options.
  3. Open the user → Member Of → Add → Remote Desktop Users (and/or Administrators).

Create a user (PowerShell)

$pw = Read-Host -AsSecureString "Password"
New-LocalUser -Name "alice" -Password $pw -FullName "Alice Smith" -PasswordNeverExpires:$false
Add-LocalGroupMember -Group "Remote Desktop Users" -Member "alice"
# admin rights only if needed:
# Add-LocalGroupMember -Group "Administrators" -Member "alice"

Other useful cmdlets:

Get-LocalUser
Get-LocalGroupMember -Group "Administrators"
Set-LocalUser -Name "alice" -Password (Read-Host -AsSecureString)
Disable-LocalUser -Name "bob"
Remove-LocalUser -Name "olduser"
Remove-LocalGroupMember -Group "Administrators" -Member "alice"

See PowerShell basics.

Secure the built-in Administrator account

The account named Administrator is the first target of RDP brute-force attacks:

  1. Create your own admin account (a less predictable name), and add it to Administrators.
  2. Log in with it, and confirm it works.
  3. Rename or disable the built-in Administrator:
Rename-LocalUser -Name "Administrator" -NewName "srv-admin-x7"
# or
Disable-LocalUser -Name "Administrator"

Make sure another admin account works before disabling it. Keep the VNC console from your VPS control panel as a fallback. See VPS VNC console.

Password and lockout policies

Open Local Security Policy (secpol.msc) → Account Policies:

  • Password policy: minimum length 14+, complexity enabled.
  • Account lockout policy: lock after 5–10 failed attempts for 15–30 minutes. This slows down RDP brute-force attacks dramatically.

Or from the command line:

net accounts /minpwlen:14 /lockoutthreshold:10 /lockoutduration:30 /lockoutwindow:30

See RDP brute-force protection.

RDP sessions and licensing

Windows Server allows two simultaneous administrative RDP sessions by default. More concurrent users require Remote Desktop Services (RDS) and RDS CALs from Microsoft. See RDP multiple sessions and RDS CAL licensing.

Audit access

  • Enable logon auditing, and review Security event IDs 4624 (success) and 4625 (failure). See Windows Server logon auditing.
  • Regularly list members of Administrators and Remote Desktop Users, and remove people who no longer need access.
Get-LocalGroupMember Administrators, "Remote Desktop Users" | Select-Object Name, PrincipalSource

Shared accounts and service accounts

  • Avoid shared logins. When several people use one account, you can’t tell who did what, and you have to change the password for everyone when someone leaves.
  • Service accounts: run scheduled tasks and services under dedicated accounts with only the rights they need, not under your personal admin account. For services, consider the built-in virtual accounts (such as NT SERVICE\<name>), which have no password to manage.
  • Offboarding: when someone leaves, disable the account immediately, review files they owned, and remove it after any handover.

Quick reference

Task PowerShell
New user New-LocalUser -Name x -Password $pw
Allow RDP Add-LocalGroupMember "Remote Desktop Users" -Member x
Make admin Add-LocalGroupMember Administrators -Member x
Disable Disable-LocalUser -Name x
List admins Get-LocalGroupMember Administrators
Lockout policy net accounts /lockoutthreshold:10

Related: Windows Server initial setup and change the RDP port.

  • Windows Server
  • PowerShell
  • Security