Turkey (Türkçe) 
The first hour after you receive a new Windows server shapes how it behaves for months. A server that sits on the internet with the default administrator account, a delivery password and no updates is exactly what automated scanners look for. This guide turns the Windows Server post-installation checklist into 15 concrete steps: identity and access, updates, firewall, Microsoft Defender, performance tuning, logging and backups. For each step you get the reason, where to do it and, where possible, a one-line PowerShell command. The list applies to Windows Server 2016, 2019, 2022 and 2025, and the order is the same whether you run a VPS or a dedicated server.
As soon as a server gets a public IP address, it becomes visible to internet-wide scanning. A Windows machine with Remote Desktop (RDP) open usually starts receiving password guesses within hours. Most of these are simple dictionary attacks, but combined with a predictable user name such as "Administrator" and a weak password they can succeed. The usual outcome of a successful login is ransomware, crypto mining, or your server being used to attack others.
The good news is that a handful of basic settings stop most of these attempts. The order below locks the door first (identity and access), then hardens the house (updates and firewall), and finally sets up routine maintenance (monitoring and backups). Follow it in sequence and an unfinished step never leaves the earlier ones exposed.
The most common mistake while changing network or firewall settings is cutting off your own RDP session. So the first job is to make sure you can reach the server by a path other than RDP.
203.0.113.10 are documentation examples; replace them with your own office or home IP address.A password that was sent by email or shown in a panel should be treated as already exposed. On first login set a new password of at least 14 characters with letters, digits and symbols, used nowhere else. Inside an RDP session, Ctrl+Alt+End opens the "Change a password" option, or run:
net user Administrator *The command asks for the new password twice without echoing it.
Almost every password-guessing attempt targets the well-known "Administrator" name. Create a named account, add it to the Administrators group and use it for daily work.
$p = Read-Host -AsSecureString "New password"
New-LocalUser -Name "ops.admin" -Password $p -PasswordNeverExpires
Add-LocalGroupMember -Group "Administrators" -Member "ops.admin"Only after you have signed in with the new account and confirmed it works, disable the built-in account, or at least rename it so attackers no longer know the user name.
Rename-LocalUser -Name "Administrator" -NewName "srv-spare-admin"
# or disable it entirely:
Disable-LocalUser -Name "Administrator"If you lock yourself out by mistake, you will need the console to get back in.
An account lockout policy blocks an account for a while after repeated failures and slows brute-force attacks dramatically. On a standalone server that is not joined to a domain:
net accounts /lockoutthreshold:5 /lockoutwindow:30 /lockoutduration:30
net accounts /minpwlen:14With these values the account locks for 30 minutes after five bad attempts. Values that are too strict let an attacker lock you out on purpose; 5 to 10 attempts and 15 to 30 minutes is a sensible range. Check the current values with net accounts.
Network Level Authentication (NLA) verifies the user before a full session is created, which helps both security and resource usage. It is on by default in recent releases, but verify it:
Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" -Name UserAuthentication -Value 1The most effective measure is allowing RDP only from known IP addresses. Add your own rule first, confirm you can connect, then disable the generic rule. Port changes, VPN-only access and session limits are covered in our RDP VPS and 10-step RDP security guide.
Install every pending security update on first login and reboot. The quickest route on both Server Core and Desktop Experience is sconfig: choose the Windows Update option to search for and install updates. On Desktop Experience, Settings > Windows Update does the same job.
Then decide when updates install. For production, "download automatically, install at a time I choose" is the most balanced approach: patches are not delayed and reboots happen in a night-time maintenance window. Monthly security updates are usually released on the second Tuesday of each month, so mark that week in your calendar.
A meaningful host name in logs and an accurate clock save a lot of time during troubleshooting, and certificates and some authentication methods depend on correct time.
Set-TimeZone -Id "Turkey Standard Time"
w32tm /resync
w32tm /query /status
Rename-Computer -NewName "WEB01" -RestartPick the time zone that matches your users. Renaming reboots the server, so leave it for last.
Every running service is potential attack surface. List installed roles and features and remove what you do not need:
Get-WindowsFeature | Where-Object Installed
Get-SmbServerConfiguration | Select-Object EnableSMB1Protocol
Set-SmbServerConfiguration -EnableSMB1Protocol $false -ForceSMBv1 is not installed by default on recent Windows Server releases, but it may still be present on an older image or an upgraded system, so check. If the server does not share files, do not expose port 445 to the internet either.
A delivered VPS already has its IP address, gateway and DNS configured. Entering a wrong gateway while "switching to a static IP" makes the server unreachable instantly. If you add extra IP addresses, use the values from the delivery email and do it with the console open. VPS, dedicated and GPU servers in our Turkey location include a free /64 IPv6 block; check assigned addresses with:
Get-NetIPAddress | Select-Object InterfaceAlias, IPAddress, PrefixLengthWindows Firewall should be configured, not disabled. The logic is simple: block all inbound traffic, open only the required ports, and where possible only for the required source addresses.
Get-NetFirewallProfile | Select-Object Name, Enabled, DefaultInboundAction
New-NetFirewallRule -DisplayName "RDP - office" -Direction Inbound -Protocol TCP -LocalPort 3389 -RemoteAddress 203.0.113.10 -Action Allow
# after confirming you can connect through your own rule:
Disable-NetFirewallRule -DisplayGroup "Remote Desktop"A web server needs ports 80 and 443 open to everyone, but database ports (1433 for MSSQL) should never face the internet. If the application runs on the same server, the database does not need to be reachable from outside at all; if another server connects, allow only that server's IP.
Volumetric network attacks cannot be stopped by a host firewall; for that layer see our DDoS firewall options.
Deploy your Windows VPS in minutes
Hosted in Istanbul with KVM virtualization and a 1 Gbps port; Windows Server 2016, 2019, 2022 and 2025 are available as ready images.
See Windows VPS plansMicrosoft Defender Antivirus ships with Windows Server. Unless you run another endpoint security product, keep it enabled with current signatures.
Get-MpComputerStatus | Select-Object AMServiceEnabled, RealTimeProtectionEnabled, AntivirusSignatureLastUpdated
Update-MpSignatureTurning Defender off "for performance" is a common but poor habit. For disk-heavy software such as SQL Server or backup agents, exclude only the folders and file types the vendor recommends, never a whole drive.
Add-MpPreference -ExclusionPath "D:\SQLData"Some images ship with the "Balanced" power plan, which can be slow to raise CPU clocks under load. "High performance" gives more consistent response times on servers.
powercfg /setactive SCHEME_MIN
powercfg /getactiveschemeOn Desktop Experience, choosing "Adjust for best performance" under System Properties > Advanced > Performance saves RAM and CPU, especially on multi-user remote desktop hosts. You can also stop Server Manager from opening at every login:
Get-ScheduledTask -TaskName ServerManager | Disable-ScheduledTaskUpdates, logs and temporary files slowly fill the system drive. A Windows server with a full system drive cannot install updates and services may stop unexpectedly. Check free space regularly:
Get-Volume | Select-Object DriveLetter, FileSystemLabel, SizeRemaining, SizeIf a plan upgrade enlarged the disk, extend the existing partition into the new space:
$max = (Get-PartitionSupportedSize -DriveLetter C).SizeMax
Resize-Partition -DriveLetter C -Size $maxKeep databases and application data on a separate volume where possible; it makes both backup and restore easier. If you are unsure how much RAM and disk you need, see the workload examples in our Windows VPS buying guide.
Under heavy password guessing, the default Security log size fills within days and older entries are lost. Increase it and keep logon auditing enabled:
wevtutil sl Security /ms:1073741824
auditpol /set /subcategory:"Logon" /success:enable /failure:enable| Event ID | Meaning | When to worry |
|---|---|---|
| 4624 | Successful logon | A logon from an unknown IP or at an unusual hour |
| 4625 | Failed logon | Hundreds in a short period mean a brute-force attempt is under way |
| 4740 | Account locked out | Your own account locks often: someone knows your user name |
| 4720 | User account created | An account you did not create may mean the server is compromised |
To count failed logons in the last 24 hours:
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=(Get-Date).AddDays(-1)} | Measure-ObjectRansomware, a deleted folder or a broken update all have one reliable cure: a tested backup. Install the built-in Windows Server Backup feature and schedule regular jobs:
Install-WindowsFeature Windows-Server-Backup
wbadmin start backup -backupTarget:E: -include:C: -allCritical -quietThe backup target must not be the same disk, and even a second disk in the same server is not enough on its own, because ransomware encrypts every drive it can reach. Keep a copy of important data elsewhere (the 3-2-1 rule: three copies, two media, one off-site). On a VPS you can also add the optional paid Backup Service add-on to this plan.
Most importantly, restore a backup at least once. A backup that has never been restored has not been proven to work.
| # | Step | Time | Priority |
|---|---|---|---|
| 1 | Change delivery password | 2 min | Critical |
| 2 | Create a named admin account | 3 min | Critical |
| 3 | Rename or disable Administrator | 2 min | High |
| 4 | Lockout and password policy | 2 min | Critical |
| 5 | RDP: NLA and IP restriction | 5 min | Critical |
| 6 | Windows updates | 15-60 min | Critical |
| 7 | Name, time zone, time sync | 3 min | Medium |
| 8 | Unused roles, SMBv1 | 5 min | High |
| 9 | Verify network settings | 3 min | Medium |
| 10 | Firewall rules | 10 min | Critical |
| 11 | Defender and exclusions | 5 min | High |
| 12 | Power plan, visual effects | 3 min | Medium |
| 13 | Disk space and partitions | 5 min | Medium |
| 14 | Log size and auditing | 5 min | High |
| 15 | Backup plus restore test | 30 min | Critical |
All steps apply to current releases, but the version matters for security too: newer releases receive security updates for longer and ship with more modern defaults. Choosing the newest version your software supports is usually the right call.
| Version | When it makes sense |
|---|---|
| Windows Server 2025 | New projects and long-lived deployments; first choice if your software supports it |
| Windows Server 2022 | Business software that needs broad compatibility; mature and stable |
| Windows Server 2019 / 2016 | Only when a legacy application will not run on a newer release |
See our Windows Server 2025 VPS guide and Windows Server 2022 VPS guide for details.
The steps are identical on both; what differs is the tooling you have when something goes wrong. On a VPS you open the console from the Client Area and can reinstall in minutes. On a dedicated server the HTML5 KVM console gives you access down to the BIOS, and you monitor hardware RAID and disk health yourself. Heavy MSSQL, multi-user remote desktop or virtualization workloads benefit from dedicated servers; a single website, a small accounting package or a test environment usually fits well on a VPS plan.
Pick the right plan for your Windows server
VPS or dedicated, you can open a support ticket 24/7 and manage console, reboot and reinstall yourself from the Client Area.
Browse Windows VPS plansWhat should I do first after receiving a Windows server?
Confirm that you can reach the console in the Client Area, then change the administrator password, create a separate admin account for yourself and install Windows updates. Move on to network and firewall settings after that.
Is changing the RDP port enough on its own?
No. A different port reduces automated scanning noise but does not protect the server. Real protection comes from strong passwords, Network Level Authentication, an account lockout policy and a firewall rule that only allows RDP from known IP addresses.
Should Microsoft Defender stay enabled on a Windows server?
Yes. Unless you have installed another endpoint security product, keep Defender enabled. For disk-heavy software such as SQL Server, add only the folders and file types the vendor recommends as exclusions instead of turning protection off.
Do I need to change the server's IP settings manually?
Usually not. Network settings are ready when the VPS is delivered, and entering a wrong IP address or gateway will cut your remote connection. If you must change something, make sure console access works first.
How should I back up a Windows server?
Use the Windows Server Backup feature to back up system state and data volumes on a schedule, and copy important data to a separate location. On a VPS you can also consider the paid Backup Service add-on. Always test a backup by restoring it.
Will these settings make the server completely secure?
No checklist guarantees complete security. These steps shrink the attack surface considerably, but they need to be maintained with regular updates, log reviews and tested backups.
