Skip to main content
After setting up a Windows Server VPS, sign in with Remote Desktop and, in this order: change the Administrator password, install all Windows updates, set the time zone and computer name, create a second admin account, confirm Microsoft Defender Antivirus and Windows Defender Firewall are on, protect Remote Desktop, and set up backups. Most steps take one PowerShell command or one SConfig menu option on Windows Server 2019, 2022 and 2025.

​
Before you start

  • Connect with Remote Desktop as Administrator.
  • Open PowerShell as Administrator: right-click Start and choose Terminal (Admin) or Windows PowerShell (Admin).
  • If RDP stops working at any point, use the VNC console to sign in.
SConfig is a text menu built into Windows Server that covers computer name, local administrators, updates, Remote Desktop, network, date and time and activation. Type SConfig in an admin PowerShell window to open it (Microsoft Learn).

​
1. Change the Administrator password

Use a long, unique password (16+ characters, stored in a password manager). Remote Desktop on the internet is a constant target for password guessing. Press Ctrl+Alt+End in the Remote Desktop window, choose Change a password, enter the old and new password and press Enter.

​
2. Install all Windows updates

Open Start > Settings > Windows Update on Windows Server 2025, or Start > Settings > Update & Security > Windows Update on Windows Server 2019 and 2022, and click Check for updates. Restart when asked and check again until no updates are left.
The first round on a new server can take a while and need more than one restart. See install Windows updates.

​
3. Set the time zone

Replace the Id with yours from the list (for example UTC). SConfig option 9 (Date and time) opens the same setting. See change the time zone and language.

​
4. Give the server a name

A random name like WIN-3F7K2... is hard to recognise in RDP and logs:
Names can be up to 15 characters, letters, numbers and hyphens. See rename a Windows server.

​
5. Create a second administrator account

If the built-in Administrator account gets locked out or its password is lost, a second admin lets you back in:
Members of Administrators can sign in with Remote Desktop. For a non-admin user, add them to Remote Desktop Users instead; see add a Remote Desktop user.

​
6. Check Microsoft Defender Antivirus

Defender is installed and enabled by default on Windows Server 2016 and later (Microsoft Learn). Confirm it is running and up to date:
Status should be Running and both Enabled values True. See use Microsoft Defender on Windows Server.

​
7. Check Windows Defender Firewall

All three profiles (Domain, Private, Public) should show True. Only open the ports your software needs; see open a port in Windows Firewall.
Don’t turn the firewall off to “test” something on an internet-facing server. Add a specific inbound rule instead and remove it when you are done.

​
8. Protect Remote Desktop

  • Keep Network Level Authentication on (SConfig option 7, choice 1).
  • Use the strong password from step 1 on every account that can sign in.
  • Consider limiting RDP to your own IP address and setting an account lockout policy. Both are covered in protect RDP from brute-force attacks.

​
9. Set up backups

​
10. Check activation

Run slmgr /xpr to see whether Windows is activated. Details and what the messages mean are in check Windows Server activation.

​
How to check it worked

  • Windows Update in Settings says You’re up to date.
  • Get-TimeZone shows your zone and hostname shows the new name.
  • You can sign in over RDP as your second admin user.
  • Get-MpComputerStatus and Get-NetFirewallProfile show protection enabled.

​
Frequently asked questions

​
Should I rename the Administrator account?

Renaming it makes guessing harder because bots try Administrator first. Do it only after your second admin account works, and update any saved RDP connections.

​
How long do the first updates take?

It depends on how recent the installation image is. Plan for at least one restart and check for updates again afterwards until none are left.

​
Do I need extra antivirus software?

Microsoft Defender Antivirus is built in and enabled by default on Windows Server. Keep it updated. If you want to use another antivirus product, read Microsoft’s guidance on running Defender alongside it first.

​
Can I install software with a package manager?

Yes. See install software with winget.

VPS and dedicated server guides

Every guide in this section.

Windows Server security checklist

The full hardening list.

Connect with Remote Desktop

Sign in from Windows.

Protect RDP from brute force

Lock down Remote Desktop.

PowerShell on Windows Server

The commands used here.
Checked against Microsoft Learn: SConfig, Set-TimeZone, New-LocalUser and Defender Antivirus on Windows Server on 4 November 2026. Steps were not tested on a live Windows server for this page; menu names can differ slightly between Windows Server 2019, 2022 and 2025.

​
Need Extra Help?

If you encounter any issues, our support team is ready to assist:

​
Save on Your Hosting

Ready to upgrade your hosting? Use code KB20 at checkout for 20% off your first order!
Last Updated: November 2026