Windows Server first steps: Remote Desktop, updates and firewall

Connect with Remote Desktop

Windows servers are managed through Remote Desktop (RDP) on TCP port 3389. On Windows, open Remote Desktop Connection (mstsc), enter your server's IP address and sign in with the administrator account and the password you set when ordering. On macOS use the Windows App, and on Linux use a client such as Remmina.

Windows may show a certificate warning the first time, because the server uses a self-signed certificate. Check the fingerprint through your provider's console if you want to be certain.

mstsc /v:YOUR_SERVER_IP

Change the administrator password

If the initial password was generated or sent to you, replace it straight away with a long unique one stored in a password manager. Use Ctrl+Alt+End inside a Remote Desktop session in place of Ctrl+Alt+Delete.

$p = Read-Host "New password" -AsSecureString
Set-LocalUser -Name "Administrator" -Password $p

Check the system and licence

Confirm the Windows version, edition and activation state. Licence keys and activation rights are not issued with the plan, so check yours separately. The commands show whether Windows considers itself licensed.

Get-ComputerInfo | Select-Object WindowsProductName, WindowsVersion, OsBuildNumber
Get-CimInstance SoftwareLicensingProduct -Filter "Name like 'Windows%' and LicenseStatus=1" | Select-Object Name, LicenseStatus

Install Windows updates

Run Windows Update from Settings, then restart. Do this before installing anything else. You can also use PowerShell with the PSWindowsUpdate module from the PowerShell Gallery. Leave automatic updates on, and schedule restarts for a quiet time.

Get-Service wuauserv
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 5

Limit who can use Remote Desktop

RDP exposed to the whole internet is attacked constantly. Restrict the built-in rule to your own public IP address or network, and keep Network Level Authentication on. If your address changes, use a VPN to a fixed address and allow that instead. Test from a second session before closing the first.

Set-NetFirewallRule -DisplayName "Remote Desktop - User Mode (TCP-In)" -RemoteAddress YOUR_PUBLIC_IP
Set-NetFirewallRule -DisplayName "Remote Desktop - User Mode (UDP-In)" -RemoteAddress YOUR_PUBLIC_IP
Get-NetFirewallRule -DisplayName "Remote Desktop*" | Get-NetFirewallAddressFilter | Select-Object InstanceID, RemoteAddress

(Get-ItemProperty "HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp").UserAuthentication

Create a standard administrator account

Create a second account for daily administration and keep the built-in Administrator for emergencies. Give it a strong password and add it to the Administrators and Remote Desktop Users groups. Test signing in with it, then consider renaming or disabling the built-in account.

$p = Read-Host "Password for deploy" -AsSecureString
New-LocalUser -Name "deploy" -Password $p -FullName "Server administrator"
Add-LocalGroupMember -Group "Administrators" -Member "deploy"
Add-LocalGroupMember -Group "Remote Desktop Users" -Member "deploy"

Set the time zone and check disk and memory

Set the time zone so logs and scheduled tasks make sense, and check free disk space and memory.

Set-TimeZone -Id "GMT Standard Time"
Get-Date
Get-PSDrive C | Select-Object Used, Free
Get-CimInstance Win32_OperatingSystem | Select-Object FreePhysicalMemory, TotalVisibleMemorySize

Back up and keep it patched

Take a backup of anything important before big changes. Windows Server Backup is a built-in feature, and files can also be copied to another machine. Check for updates weekly and restart when asked.

Install-WindowsFeature Windows-Server-Backup
Get-WindowsFeature Windows-Server-Backup