A freshly delivered Windows VPS is functional, but deserves a few adjustments before you install services on it that are exposed to the internet.
1. Change the administrator password
On your very first connection, replace the default password with a long, unique one — at least 14 characters, with uppercase letters, digits and special characters. From the Control Panel or Windows Settings, under Accounts.
2. Create a dedicated user for everyday work
3. Change the default RDP port
The default RDP port (3389) is the first target of automated scans. Changing it does not make the connection intrinsically more secure, but it sharply reduces the volume of automated connection attempts in your logs.
In the Windows Registry (regedit), the key is found under:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp\PortNumber4. Enable automatic updates
Check in Windows Update that security updates install automatically — it is the simplest and most effective protection against vulnerabilities that are already patched but exploited en masse as soon as they are published.
5. Configure the Windows firewall
See the dedicated article on managing the Windows firewall: open only the ports actually used by the services you intend to expose.
6. Limit RDP connection attempts
An account lockout policy after several failed sign-ins (configurable in the local security policies, secpol.msc) limits how effective a brute-force attack on the password can be.