Windows Server VDS Setup: RDP Security and First Settings

A Windows Server VDS is ready to use within minutes of deployment, but it is not ready to be exposed to the internet. For a new Windows Server 2022 or 2025 VDS, the first hour should go to restricting RDP, patching, fixing network settings, and understanding what your license does and does not cover.

This guide walks through that first hour in order, with PowerShell you can paste into an elevated session.

Choose the Windows Server version

Both versions run well on a VMware vSphere-based VDS. The practical differences:

If your application vendor has not certified 2025 yet, deploy 2022. If you are starting fresh and your software supports it, 2025 gives you the longer support window. Either way, confirm the exact support dates on Microsoft's lifecycle page rather than relying on a blog post.

Step 1: Log in and change the password immediately

Your initial Administrator credentials usually arrive by email or through the control panel. Treat them as compromised the moment they are sent.

1. Connect with mstsc (Windows) or an RDP client such as Remmina or Microsoft's Windows App on macOS.
2. Change the password to a unique passphrase of 16+ characters.
3. Store it in a password manager.

$pw = Read-Host -AsSecureString "New password"
Set-LocalUser -Name "Administrator" -Password $pw

Step 2: Lock down RDP

RDP on TCP 3389 open to the world is scanned and brute-forced within minutes of a server getting a public IP. Do these in order of impact.

Restrict by source IP

The single most effective control is not letting strangers reach the port at all. Disable the built-in rule group and create a scoped rule:

Disable-NetFirewallRule -DisplayGroup "Remote Desktop"

New-NetFirewallRule -DisplayName "RDP - admin only" `
  -Direction Inbound -Protocol TCP -LocalPort 3389 `
  -RemoteAddress 203.0.113.10,198.51.100.0/24 `
  -Action Allow -Profile Any

Replace the example addresses with your own office or VPN egress IPs. Before you disconnect, open a second RDP session to confirm the new rule works. Locking yourself out is the most common mistake here. If it happens, use the provider's console access in the control panel to fix the firewall.

If you have no static IP, put the server behind a VPN and allow RDP only from the VPN subnet. A VPN service or your own WireGuard/OpenVPN gateway works for this.

Require Network Level Authentication

NLA forces authentication before a full session is created, which reduces resource abuse and pre-auth attack surface.

Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" `
  -Name "UserAuthentication" -Value 1

Add an account lockout policy

net accounts /lockoutthreshold:5 /lockoutduration:30 /lockoutwindow:30

Five failed attempts lock the account for 30 minutes. Be aware this also lets an attacker lock out a known account name. That is another reason to combine it with IP restriction, and to rename the built-in account:

Rename-LocalUser -Name "Administrator" -NewName "svc-admin-x7"

Changing the RDP port: useful, but not security

Moving RDP to a nonstandard port reduces log noise from bots. It does not stop a targeted scan. If you do it, change the PortNumber value under the same RDP-Tcp registry key, add a firewall rule for the new port, and restart the Remote Desktop service. Do not treat it as a replacement for source restrictions.

Watch the logs

Failed logons are event ID 4625:

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625} -MaxEvents 20 |
  Select TimeCreated, @{n='IP';e={$_.Properties[19].Value}}

A steady stream of failures from random IPs means your rule is not working or another service (for example SMB or a web app login) is exposed.

Step 3: Patch before installing anything

Template images age. Install current updates first, then reboot.

Install-Module PSWindowsUpdate -Force
Get-WindowsUpdate -AcceptAll -Install -AutoReboot

You can also use Settings > Windows Update. Plan a maintenance window; some servers need two or three reboot cycles.

Step 4: Verify networking and basics

Most VDS deployments come with the IP preconfigured, but verify it. If you must set it manually, use the values from your control panel (documentation addresses shown here):

New-NetIPAddress -InterfaceAlias "Ethernet0" -IPAddress 192.0.2.25 `
  -PrefixLength 24 -DefaultGateway 192.0.2.1
Set-DnsClientServerAddress -InterfaceAlias "Ethernet0" `
  -ServerAddresses 1.1.1.1,9.9.9.9

Then set the identity and clock:

Rename-Computer -NewName "web01" -Restart
Set-TimeZone -Id "UTC"
w32tm /resync

Using UTC on servers makes log correlation much easier across regions. Also:

• Confirm VMware Tools is installed and running (Get-Service VMTools). It is needed for correct time sync, graceful shutdown, and driver support.
• Check disk size with Get-Volume. If you upgraded the plan and C: did not grow, extend it:

$max = (Get-PartitionSupportedSize -DriveLetter C).SizeMax
Resize-Partition -DriveLetter C -Size $max

• Keep Windows Defender Firewall on for all profiles. Open only the ports your services need.

Step 5: Ready-made images: Plesk and MSSQL

Many providers offer templates with Plesk or Microsoft SQL Server preinstalled. Availability and editions differ by provider and plan, so check the order form or ask support what is offered before you deploy. If you work with Nixcon, the VDS page is the place to start.

Plesk on Windows. Good for hosting several sites with IIS, mail, and DNS from one panel. After deployment:

• Change the Plesk admin password and enable two-factor authentication.
• Restrict port 8443 (the Plesk panel) with the same source-IP approach as RDP.
• Run Plesk's own updates in addition to Windows Update.
• Remember that Plesk is licensed separately from Windows.

MSSQL. Decide on the edition first:

• Express is free but limited, with a 10 GB database size cap per database and limited CPU and memory usage.
• Web and Standard are paid editions licensed through your provider or your own agreement.

Security notes for either: never expose TCP 1433 to the whole internet. Bind it to a private interface or allow only application server IPs.

New-NetFirewallRule -DisplayName "MSSQL app servers" -Direction Inbound `
  -Protocol TCP -LocalPort 1433 -RemoteAddress 198.51.100.20 -Action Allow

Also disable the sa login or give it a long random password, enforce Windows or contained-database authentication where possible, and put backups on a different volume or off-server.

Licensing notes

Licensing is where Windows VDS buyers are most often surprised. General points to verify with your provider:

• Windows Server license. On hosted VDS it is typically included in or added to the monthly plan through the provider's licensing program. Bringing your own license is only possible if Microsoft's terms and the provider allow it. Ask first.
• Remote administration. Windows Server permits two concurrent administrative RDP sessions without extra licenses.
• Remote Desktop Services (RDS). If multiple users need desktop sessions, such as a terminal server, you need RDS CALs plus the RDS role. Using it without them is a compliance issue.
• Client Access Licenses (CALs). Depending on the use case, Windows Server CALs may be required for users or devices accessing the server. Your provider or Microsoft licensing partner can clarify.
• SQL Server, Plesk, and other software. Each has its own license. Express editions and Plesk trial or limited editions have feature or time limits.
• Activation. Windows normally activates against the provider's KMS or licensing service. A server that falls out of activation should be reported rather than "fixed" with third-party tools.

Keep records of what you are licensed for. If an audit happens, these records matter.

Step 6: Consider DDoS and monitoring

A Windows server hosting game services, web apps, or anything with a public profile can attract volumetric traffic that the guest OS cannot fix. Upstream DDoS protection and firewall filtering works before traffic reaches the VM. It also reduces the time you spend tuning rules inside Windows. Back it with monitoring so you notice anomalies early.

Common mistakes and fixes

First-hour checklist

1. Change the Administrator password and rename the account.
2. Restrict RDP by IP or VPN, then test from a second session.
3. Enable NLA and a lockout policy.
4. Install updates and reboot.
5. Verify IP, DNS, time zone, VMware Tools, and disk size.
6. Install or configure Plesk or MSSQL and secure their ports.
7. Record license details and set up backups.

Doing these seven things puts a new Windows Server VDS well ahead of the typical exposed default install.