Windows Server: first login, RDP and updates

Windows Server 2025 and 2022 Standard install in one click. A new Windows server is typically online about 20 minutes after payment confirmation, and the delivery email contains its IP address and the Administrator password.

License and billing

The Windows Server license is billed monthly with the server: $2.75 per physical core per month, with a minimum of 8 cores. Prices exclude VAT.

The license covers the operating system and up to two simultaneous administrative Remote Desktop sessions. Remote Desktop Services for end users requires separate RDS licensing, which is not included.

First login over RDP

• Windows: run mstsc /v:203.0.113.10 or open Remote Desktop Connection.
• macOS: use Microsoft’s Windows App (formerly Microsoft Remote Desktop).
• Linux: use Remmina, or xfreerdp /v:203.0.113.10 /u:Administrator (xfreerdp3 on newer distributions).

Log in as Administrator with the password from the email, and accept the certificate warning: the server uses a self-signed RDP certificate until you install your own. Change the password right away: press Ctrl+Alt+End in the session and choose Change a password, or run in PowerShell:

Set-LocalUser -Name Administrator -Password (Read-Host -AsSecureString "New password")

Install updates

Install the latest cumulative update before you expose any service:

• Desktop Experience: Settings → Windows Update → Check for updates.
• Any installation, including Server Core: run sconfig in PowerShell and choose option 6 (Install updates). Option 5 (Update setting), then A, switches to automatic updates, installed every day at 3:00 AM server time.

Cumulative updates need a reboot, and your services are down until Windows is back. Schedule it for a quiet hour.

Restrict Remote Desktop

An RDP port open to the world receives constant password-guessing attempts from bots. Reduce the exposure step by step.

1. Allow RDP only from your addresses. Create a rule for your IPv4 and IPv6 addresses, then disable the built-in rules that allow everyone:

   PowerShell

   New-NetFirewallRule -DisplayName "RDP from admin IPs" -Direction Inbound -Protocol TCP -LocalPort 3389 -RemoteAddress 198.51.100.7,2001:db8:abcd::/48 -Action Allow
   Disable-NetFirewallRule -DisplayGroup "Remote Desktop"

   Without the built-in UDP rule, RDP simply runs over TCP.

2. Keep Network Level Authentication on. NLA requires valid credentials before a session starts and is on by default. This check returns 1 when it is enabled:

   PowerShell

   (Get-CimInstance -Namespace root\cimv2\TerminalServices -ClassName Win32_TSGeneralSetting -Filter "TerminalName='RDP-tcp'").UserAuthenticationRequired

3. Stop using the name Administrator. Bots try it first. Create your own administrator, log in with it in a new session, then disable the built-in account:

   PowerShell

   New-LocalUser -Name "deploy" -Password (Read-Host -AsSecureString "Password")
   Add-LocalGroupMember -Group "Administrators" -Member "deploy"
   Disable-LocalUser -Name "Administrator"

4. Lock accounts after failed attempts: here, 15 minutes after 10 wrong passwords.

   PowerShell

   net accounts /lockoutthreshold:10 /lockoutwindow:15 /lockoutduration:15

5. Better still, hide RDP. Connect through a VPN such as WireGuard and allow port 3389 only from the VPN subnet, or publish RDP over HTTPS with the RD Gateway role, which requires RDS licensing.

Enable IPv6

Your server comes with a routed /64. Check whether an address from it is already configured:

Get-NetIPAddress -AddressFamily IPv6

If you only see fe80:: link-local addresses, find the adapter name with Get-NetAdapter, then add an address from your /64 and the IPv6 gateway shown in your dashboard (fe80::1 in this example):

New-NetIPAddress -InterfaceAlias "Ethernet" -IPAddress 2001:db8:1234:5678::1 -PrefixLength 64
New-NetRoute -InterfaceAlias "Ethernet" -DestinationPrefix "::/0" -NextHop fe80::1

With netsh, the equivalent is netsh interface ipv6 add address "Ethernet" 2001:db8:1234:5678::1/64 followed by netsh interface ipv6 add route ::/0 "Ethernet" fe80::1. In the GUI, open ncpa.cpl, then the adapter’s Internet Protocol Version 6 (TCP/IPv6) properties. Test with ping -6 towards a host you know has IPv6, and add your own IPv6 address to the RDP rule if you connect over IPv6. More in Configure your /64 IPv6 subnet.

Add additional IPv4 addresses

Additional IPv4 addresses ($2.50 per IP per month, see Additional IPv4 addresses) go on the same adapter. They are routed to your main IP, so add them with a /32 mask, and mark them SkipAsSource so that outgoing connections keep using the main IP:

New-NetIPAddress -InterfaceAlias "Ethernet" -IPAddress 198.51.100.20 -PrefixLength 32 -SkipAsSource $true

In the GUI: adapter properties → Internet Protocol Version 4 (TCP/IPv4) → Advanced → IP addresses → Add, with the subnet mask 255.255.255.255.

If RDP is unreachable

In your dashboard, open the server and choose Console (IPMI). Use the console’s Ctrl+Alt+Del function to reach the login screen, sign in, and check the network and Remote Desktop from PowerShell:

Get-NetIPAddress -AddressFamily IPv4
Get-NetRoute -DestinationPrefix 0.0.0.0/0
Get-Service TermService
Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections -Value 0
Enable-NetFirewallRule -DisplayGroup "Remote Desktop"

The last two lines turn Remote Desktop back on and reopen its default firewall rules; restrict them again once you are back in. If Windows no longer boots, copy your data off from rescue mode before you reinstall.

Next steps

• See what the included network protection covers in How DDoS protection works on your server.
• Compare Windows Server with the other systems on Operating systems.
• Still locked out? Contact support: IPMI access and OS install issues are in scope, 24/7.