How to secure a Windows VPS

Why this matters

Any server with Remote Desktop open is found by automated tools that try common usernames and passwords all day. A weak password is the most common way servers get taken over. You are the administrator of your VPS, so security is your job. These steps are the basics.

1. Set a strong password

• Use at least 16 characters, with letters, numbers and symbols.
• Use a password you have never used anywhere else.
• Store it in a password manager instead of a note or a chat.

Change the password you were given after your first login. See how to change the Administrator password.

2. Run Windows Update now, and keep doing it

1. Open Settings, then Update and Security (or use Server Manager).
2. Install all available updates and restart when asked.
3. Check again every few weeks.

Updates fix the security holes that attackers use.

3. Keep Network Level Authentication switched on

Network Level Authentication (NLA) makes a person prove who they are before a full session is created. It stops many attacks early.

1. Right-click This PC, choose Properties, then Remote settings.
2. Make sure "Allow connections only from computers running Remote Desktop with Network Level Authentication" is ticked.

4. Use the built-in antivirus

Windows Server includes Microsoft Defender. Keep it on and updated. Do not install software from sources you do not trust, and do not open unknown attachments on the server.

5. Limit who has the password

Do not share the Administrator password in chats or emails. If someone else needs access, give them their own user account instead.

6. Open only what you need

Your server needs Remote Desktop to be reachable. Do not open other ports unless a program you run needs them. If you install web or database software, keep it updated and use strong passwords for it too.

If you always connect from the same fixed IP address, you can set Windows Defender Firewall to allow Remote Desktop only from that address. Be careful, because a wrong rule can lock you out. If it happens, contact support.

7. Check for failed logins

Windows records failed sign-ins. To look:

1. Open Event Viewer.
2. Go to Windows Logs, then Security.
3. Look for Event ID 4625, which means a failed logon.

A few failures are normal. Hundreds in a short time mean someone is guessing your password. A strong password makes that harmless, but it is a reminder to check yours.

8. Make backups

Security is also about recovery. If something goes wrong, a recent backup saves you. See how to back up a Windows VPS.