All products 
Windows VPS: licensing, RDP and secure sign-in
A Windows server costs more than Linux not only because of memory: the price includes a licence, and how it is arranged decides whether you are compliant and how many people can connect. An exposed RDP port is also the most common way such servers get hacked. Here are both topics.
Choosing the Windows Server version and the right amount of memory is covered on the selection pages. This article is about two things a plan usually describes in one line or not at all: on what basis the host gives you Windows, and how to make sure only you can sign in. Check both before paying: re-licensing a server or rebuilding it after a breach costs more than picking the right plan from the start.
How hosts license Windows Server
A host does not buy a boxed copy of Windows for every customer. Providers use Microsoft's SPLA programme (Services Provider License Agreement): licences are rented and paid to Microsoft monthly based on actual use. That is why Windows is a monthly surcharge in the plan and why it disappears when you delete the server.
Under SPLA, Windows Server is licensed per core. When licensing by virtual machine, the host pays for as many core licences as the VM has virtual cores, but no fewer than eight per VM. So the Windows surcharge on a small 1–2 vCPU plan is almost the same as on an 8 vCPU plan, and as a share of the server price it looks large. On cheap plans Windows sometimes costs more than the server itself.
What to check in the plan description:
- it states explicitly that the licence is included in the price or added as an option, not just "Windows image" or "Windows installation";
- which edition: Standard or Datacenter. For a single VPS it usually makes no difference to you; what matters is that there is a licence;
- how much Windows costs on renewal and when you add cores.
If the plan only provides a system image without a licence, Windows will run unactivated with reminders and restrictions, and the compliance of that use is on you.
Can you bring your own licence
Technically yes: on KVM you can boot your own ISO image. Legally it depends on the type of licence.
- Retail and OEM keys sold in online stores do not give the right to run Windows Server on a host's shared hardware. An OEM licence is also tied to one specific physical server.
- Volume licences with Software Assurance or subscription licences can since October 2022 be moved to third-party providers, including shared hardware (the Flexible Virtualization Benefit). The exception is the largest public clouds on Microsoft's list, which have separate rules.
If the company has no active Software Assurance, a plan with the host's licence is simpler and safer. Your own licence makes sense when it is already paid for under a volume agreement.
Desktop Windows 10 and 11 are a separate case. They are not part of SPLA, and their licence terms are not designed for rental on shared hardware. Details are on the VPS with Windows 10 and VPS with Windows 11 pages.
How many people can connect over RDP
Without additional licences, Windows Server accepts two simultaneous RDP connections, intended for administration. If staff work on the server, such as accounting, managers or operators, you need the Remote Desktop Session Host role and a licence for each user.
| Scenario | What you need | Who pays |
|---|---|---|
| 1–2 administrators | Nothing beyond the Windows Server licence | Included in the plan |
| Staff work on the server | RD Session Host role and a licence per user | From the host: an RDS SAL per user per month |
| Your own licence infrastructure | An RDS licensing server and rights to use it at a provider | The company, under its own agreement |
Under SPLA the per-user licence is called an RDS SAL and is counted monthly: if a user was given access for even one day of the month, the whole month is paid. Ask the host whether it sells these licences and at what price; for a small team this can double the server budget. How to size memory and cores per user is described on the RDP server page.
Why RDP is attacked most
Port 3389 is scanned constantly: a new Windows server with RDP open starts receiving sign-in attempts within minutes of getting its IP. There are two main threats.
- Password guessing. Bots try common usernames, Administrator first of all, and passwords from leaked databases. This is the most frequent cause of break-ins.
- Vulnerabilities in the RDP service itself. An example is BlueKeep (CVE-2019-0708) in 2019: a flaw in older Windows versions allowed code execution without a password. The fix shipped in updates, and no system without it should be on the internet.
Protection is built in layers: first limit who can reach RDP at all, then make sign-in harder, then close vulnerabilities with updates.
Layer 1: network
- IP allowlist. Allow the RDP port in Windows Firewall for your own addresses only. If the host offers a network filter in its panel, duplicate the rule there so unwanted traffic never reaches the server.
- Corporate private network. If staff addresses change, connect them to the server through the company VPN gateway and let RDP listen only on the internal network. How to build that setup is explained in Corporate network on a VPS.
- Remote Desktop Gateway (RD Gateway). It carries RDP inside HTTPS over port 443, checks users against access policies and lets you add a second factor. Useful when there are many users and you would rather not install VPN clients for them.
Moving RDP off port 3389 reduces log noise but does not protect you: scanners find RDP on non-standard ports too.
Layer 2: sign-in
- Network Level Authentication (NLA). The user enters credentials before the server opens a full session. This saves resources during brute-force attempts and blocks some vulnerabilities that trigger before sign-in. It should always be on.
- Lockout policy. On systems installed with the October 2022 updates or newer, a lockout of 10 minutes after 10 failed attempts applies by default, including for the built-in administrator. Older images may not have it; check in Local Security Policy.
- Separate accounts. Every employee gets their own account without administrator rights. Rename or disable the built-in Administrator, and change the password the host sent you at the first sign-in.
- Second factor. For servers with access to money and personal data, add two-factor authentication through RD Gateway or a third-party Windows sign-in solution.
Layer 3: updates and recovery
Fixes for RDP, SMB and the Windows kernel ship every month on the second Tuesday. Turn on automatic installation with a reboot in a night window and keep an eye on the version's support dates: Windows Server 2016 receives fixes until 12 January 2027, 2019 until 9 January 2029, 2022 until 14 October 2031, and 2025 until 14 November 2034. A server on an unsupported version stays vulnerable no matter how well sign-in is locked down.
Keep a data backup off the server and a snapshot of the clean system after setup. If the security log shows a successful sign-in from an unknown address, it is safer to reinstall from a template and restore the data than to hunt for what the attacker changed. Version specifics are on the Windows Server 2022 and Windows Server 2025 pages.
Checklist: the first hour on a Windows VPS
- The plan description mentions a Windows Server licence, and the renewal price is known.
- If there are more than two users, RDS SALs from the host are sorted out.
- The host's password is replaced, and the built-in Administrator is renamed or disabled.
- NLA is on, and the account lockout policy is in effect.
- RDP is open only to your IPs, through the company private network or through RD Gateway.
- Automatic updates are on, and the Windows version is still supported.
- There is a data backup off the server and a snapshot taken after setup.
Plans with the licence already included are collected in VPS with Windows and cheap Windows VPS. General server selection criteria are in How to choose a VPS.