Initial Setup of a Windows VPS after Delivery

Introduction

After receiving a Windows VPS, it is critical to perform full initial setup to ensure:

• Secure and limited access for authorized users
• System updates to fix security vulnerabilities
• Preparation for hosting applications or services

Initial Access to the VPS

1. Retrieve the public IP, username, and password provided by VeryCloud.
2. On your Windows client, open Remote Desktop Connection (RDP) (mstsc.exe).
3. Enter the VPS IP address and log in using the Administrator account.

Tip: Ensure your internet connection is secure before connecting via RDP.

Change Administrator Password

Immediately secure the default account:

1. Log in to the VPS.
2. Press CTRL + ALT + END and select Change a password.
3. Choose a strong password:
   • At least 12 characters
   • Mix of uppercase, lowercase, numbers, and symbols
   • Unique and not used elsewhere

Create a New Administrator User

To reduce the use of the default Administrator account:

1. Open PowerShell as Administrator and run:

# Create a new user
net user SecureAdmin StrongPasswordHere /add

# Add the user to administrators group
net localgroup Administrators SecureAdmin /add

2. Log out from Administrator and log in with the new user.
3. Optionally, rename or disable Administrator:

# Rename Administrator
wmic useraccount where name='Administrator' rename 'AdminOld'

# Or disable it
net user Administrator /active:no

Tip: Leaving Administrator active but renamed can help with emergency recovery.

Windows Update

Apply security updates:

1. Open PowerShell as Administrator and run:

sconfig

2. Select option 6 – Download and install all updates.
3. Restart the VPS once updates are complete.
4. Ensure Windows Update is working and automatic updates are enabled.

Configure Windows Firewall

1. Make sure Windows Defender Firewall is enabled:

Get-NetFirewallProfile | Format-Table Name, Enabled
Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled True

2. Create restrictive rules to limit access to services (RDP, HTTP, etc.):

# Allow RDP only from your IP
New-NetFirewallRule -DisplayName "RDP - Personal IP" -Direction Inbound -Protocol TCP -LocalPort 3389 -RemoteAddress <YOUR_IP> -Action Allow

Secure RDP Access Configuration

1. Avoid using the default port (3389); change it in the Windows registry:

# Open regedit and modify:
# HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\TerminalServer\WinStations\RDP-Tcp\PortNumber

2. Enable Network Level Authentication (NLA) for added security.
3. Configure login alerts and limit failed attempts.

Install Basic Tools

Depending on your intended use, install:

• Web browsers: Chrome, Firefox
• Archive management: 7-Zip
• File editors: Visual Studio Code, Notepad++
• Monitoring agents: Zabbix, Wazuh, etc.
• Antivirus / Defender: Ensure Microsoft Defender Antivirus is active

Tip: Avoid installing unnecessary software to reduce the attack surface.

Security Best Practices

• Disable unnecessary Windows services (e.g., SMBv1, print services if unused)
• Maintain users with limited rights
• Monitor RDP login logs and failed attempts
• Enable logging and alerts for sensitive actions
• Use strong and unique passwords for each account
• Keep antivirus active and signatures up to date

Useful Resources

• Microsoft Documentation – Windows Server Security
• Remote Desktop Connection Guide