Your first hour on an offshore Windows RDP

A fresh Windows Server is more exposed on first boot than a fresh Linux box, mostly because more services listen by default and the remote-desktop port is famously scanned. None of this is hard to fix, but it is worth doing in the first hour rather than the first month.

Before anything else

1. 01Change the administrator passwordTo something long and generated. RDP brute-forcing is constant and entirely automated, and a weak administrator password is the single most common way these machines are lost.
2. 02Confirm network-level authentication is onIt requires authentication before a session is established, which removes an entire class of pre-auth attacks. It is on by default on Server 2022 — verify rather than assume.
3. 03Scope the firewall ruleIf you connect from a stable address, restrict 3389 to it. If you do not, at least enable account lockout so brute-forcing costs the attacker something.
4. 04Run Windows Update to completionIt will want several reboots. Do them now rather than in the middle of something later.

Then the useful settings

• Create a standard user for daily work and keep administrator for administration. Windows makes this awkward and it is still worth doing.
• Turn off automatic clipboard and drive redirection unless you need them. They are a convenient bridge in both directions.
• Set the time zone and locale before installing anything that cares — several applications bake it in at install time.
• Disable Server Manager at logon. It costs seconds on every session and tells you nothing you did not already know.

On licensing

The Windows Server 2022 license is genuine, activated and included in the price. Windows Update works normally and will keep working. If you have used hosts that ship cracked keys, the tell is a machine that deactivates itself a few weeks in, usually while you are relying on it — which is why we do not do that.

Published by NoDMCAVPS, an offshore host that files automated DMCA notices instead of forwarding them. What we still remove is listed in the acceptable use policy.