A Windows VPS arrives with an IP, the Administrator account and a password. It is reachable by Remote Desktop from the whole internet on the standard port, which is exactly what the password-guessing bots are looking for. Twenty minutes of housekeeping fixes that and saves you a bad week later.
1. Connect and change the password
Open Remote Desktop (mstsc on Windows; Microsoft Remote Desktop on Mac, iOS and Android), enter the IP, log in as Administrator. Press Ctrl+Alt+End (not Delete; that goes to your own machine), choose Change a password, and set a long one of your own. A passphrase of four or five words is easier to type over RDP than a string of symbols and just as strong.
2. Move RDP off port 3389
In PowerShell as administrator:
Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name PortNumber -Value 33890
New-NetFirewallRule -DisplayName 'RDP 33890' -Direction Inbound -Protocol TCP -LocalPort 33890 -Action Allow
Restart-Service TermService -ForcePick any port between 10000 and 60000 instead of 33890. Reconnect with your.server.ip:33890. Then remove the old rule for 3389 in Windows Firewall. Most automated attacks only try the default port; this one change removes the bulk of them.
3. Lock RDP to your IP, if you can
If your office or home has a fixed IP, edit the new firewall rule's Scope tab and set Remote IP address to that IP only. If your IP changes, skip this and rely on the port change and the password. Do not disable the firewall "to make it work"; fix the rule.
4. Windows Update, on your schedule
Settings, Windows Update, check for updates and install everything. Then Advanced options, Active hours: set them to cover the hours your application must be running. For a trading VPS that is most of the day; for a Tally server, office hours. Restarts will wait for the gap.
5. Time zone and a second administrator
Settings, Time and language, set to India Standard Time; Tally and log files will thank you. Then create a second local administrator account with its own password. If you ever lock the first one, the second gets you in without a ticket.
6. Now install what you came for
Tally, MetaTrader, IIS, SQL Server Express, Plesk. The licence on a URLStart Windows VPS is activated before delivery; you will not see an activation prompt. If you brought your own licence, Settings, Activation is where it goes.
Things not to do
Do not browse the web from the server. Do not turn off Defender. Do not leave the Administrator account as the only login. Do not install a third-party "optimiser". A server that only runs the one application it was bought for stays fast and stays clean.
Questions we get asked
Can two people use the server at once? Two administrative RDP sessions by default. For more simultaneous desktops, Remote Desktop Services licences are needed; ask us.
Why Ctrl+Alt+End? Ctrl+Alt+Delete is caught by your own PC. Ctrl+Alt+End sends it to the remote desktop.
I changed the port and cannot connect. Check the firewall rule was created before the service restarted. If you are locked out, open a ticket; we have console access.
Is Windows Defender enough? For a server that runs one application and is not used for browsing, yes.
How much RAM for Windows Server? 4 GB runs one light application; 8 GB is comfortable for Tally or MetaTrader with several terminals; 16 GB for IIS plus SQL.
