Initial setup checklist for a new Windows Server VPS

A freshly provisioned Windows Server VPS is functional but not finished. Before you install anything or open it up to the internet, work through this checklist. Everything below can be done either through the GUI (Server Manager, Control Panel) or PowerShell, run as Administrator.

1. Set a strong Administrator password

If your provider set a temporary or auto-generated password, change it immediately. Use a long, random password (a password manager helps here) rather than a memorable phrase. To change it from PowerShell:

$newPassword = Read-Host -AsSecureString "Enter new password"
Set-LocalUser -Name "Administrator" -Password $newPassword

Or use Ctrl+Alt+End in an RDP session (the equivalent of Ctrl+Alt+Delete) and choose “Change a password”.

2. Set the hostname

Default computer names (often something like WIN-XXXXXXXXXXX) are unhelpful once you’re managing more than one server. Rename it to something meaningful:

Rename-Computer -NewName "WEB01" -Restart

Note the -Restart switch: a hostname change requires a reboot to take effect. Do this early, before you’ve set up services that reference the old name.

3. Set the correct timezone

Servers are commonly left on UTC or the timezone of the datacentre location, not the timezone that’s actually useful for your logs and scheduled tasks. Check and set it:

# List available timezone IDs
Get-TimeZone -ListAvailable | Select-Object Id

# Set the timezone
Set-TimeZone -Id "GMT Standard Time"

On older systems where Set-TimeZone isn’t available, the equivalent command-line tool is tzutil:

tzutil /s "GMT Standard Time"

4. Check Windows Update status

A VPS image may have been built weeks or months before you provisioned it. Check for and install updates straight away, via Settings > Windows Update in the GUI, or with the PSWindowsUpdate PowerShell module:

Install-Module PSWindowsUpdate -Force
Get-WindowsUpdate
Install-WindowsUpdate -AcceptAll -AutoReboot

PSWindowsUpdate isn’t part of the base OS, so the first line installs it from the PowerShell Gallery. After patching, decide on an ongoing update strategy: fully automatic, or scheduled maintenance windows where you control the timing of reboots.

5. Confirm Windows Defender Firewall is on and sane

Windows Defender Firewall is enabled by default on all three network profiles (Domain, Private, Public), and that’s the state you want it in. Check its status:

Get-NetFirewallProfile | Select-Object Name, Enabled

Review which inbound rules are already enabled, and disable or remove anything you don’t need. Only open the ports required for services you’re actually running. We cover locking down Remote Desktop specifically in a separate post, since it’s the port that matters most on a fresh server.

6. Create a non-Administrator account for day-to-day use

Running everything as the built-in Administrator account is common on a VPS, but it isn’t good practice. Where you’re going to be doing routine work such as browsing, editing files, or running scripts that don’t need elevation, create a standard user account and only elevate when you actually need to:

$password = Read-Host -AsSecureString "Enter password for new user"
New-LocalUser -Name "andrew" -Password $password -FullName "Andrew" -Description "Day-to-day account"
Add-LocalGroupMember -Group "Administrators" -Member "andrew"

The example above still adds the account to Administrators (since on a single-purpose VPS you’ll often need elevated rights anyway), but a separate named account gives you proper audit trails and lets you disable RDP logon for the built-in Administrator account entirely, which is a common and worthwhile hardening step.

Work through this list in order on every new server before you deploy anything to it. It takes fifteen minutes and removes most of the easy wins an opportunistic attacker or scanner would otherwise find, the same kind of basic hardening covered in our wider website security guides. It’s also worth taking a fresh backup once the checklist is done, so you have a known-good baseline to restore to if anything goes wrong later.