Windows VPS / Dedicated Server – Onboarding, Security & Hardening Guide (v5 Expanded Edition)

Welcome to iCoreHosting’s Windows VPS / Dedicated Server environment. This v5 expanded edition provides a complete, enterprise-grade onboarding framework including deployment direction, networking, RDP access, DNS guidance, Windows roles, baseline security, legal compliance, and patch management. All content is aligned with production-level hosting requirements and Malaysian regulatory expectations.

Table of Contents

1. Service Direction & Deployment Planning
2. Server Overview & Initial Preparation
3. Login & Access (RDP)
4. Network Configuration
5. Nameservers & DNS Guidance
6. Windows Server Roles Overview
7. Security Baseline
8. Local Government Rules Reminder
9. System Updates & Patch Management
10. Web Server, IIS, SMTP & Application Deployment
11. Backup Policy (No Backup Included)
12. Sub-Hosting / User Responsibility
13. Monitoring & Logs
14. Performance Optimization
15. Advanced Security Hardening
16. Storage, File Count & Quota Management
17. Common Misconfigurations
18. Responsibility Breakdown
19. Support Information

1. Service Direction & Deployment Planning

Determining the correct deployment direction ensures your Windows VPS or dedicated server is configured properly from day one. Windows-based hosting is often used for business-critical applications, corporate environments, and system-specific workloads. Proper planning prevents misconfiguration, instability, and future downtime.

1.1 Suitable Use Cases for Windows Hosting

• Remote Desktop Workstations: Office productivity, accounting software, and multi-user remote operations.
• Corporate Application Hosting: HRMS, ERP, CRM, warehouse or inventory applications.
• ASP.NET / IIS Web Hosting: Hosting ASP.NET, MVC apps, backend APIs, and enterprise portals.
• Development or Testing Environments: Visual Studio development, application testing, staging servers.
• Windows-Based Services: Custom software that requires Windows dependencies or DLL-driven frameworks.
• Lightweight SMTP Relay: Transactional email from Windows-based applications.

1.2 Deployment Considerations (+20% Expanded)

• Performance Needs: Estimate required CPU, RAM, and storage based on user load and system complexity.
• RDP User Count: Determine if multi-user access is needed, and whether RDS licensing applies.
• Application Stack Requirements: Required .NET versions, IIS modules, SQL Server editions, COM objects, or Windows-specific services.
• Backup Requirements: Windows servers include no backup by default; customers must plan off-site backups from day one.
• Security Target: RDP must be hardened immediately; brute-force attacks begin within minutes for public-facing servers.
• Compliance Needs: Windows servers hosting customer data must comply with PDPA and CMA regulations.
• Network Behaviour: Ensure bandwidth capability is sufficient for RDP, file transfer, and application usage.

2. Server Overview & Initial Preparation

Before starting operations, review all credentials and ensure your administrative environment is secure. The following details are included in the welcome email.

2.1 Verify Server Information

• Primary IP Address
• RDP Port (default: 3389 unless changed)
• Administrator Username
• One-Time Login Password
• Hostname
• Gateway & DNS resolvers

2.2 Initial Security Tasks (Mandatory)

• Change the Administrator password (minimum 15–20 characters)
• Enable Network Level Authentication (NLA)
• Set Windows Firewall to block unauthorized connections
• Set timezone to GMT +8 Asia/Kuala_Lumpur
• Install all pending Windows Updates
• Disable Guest account
• Review existing user accounts for security risks

3. Login & Access (RDP)

Remote Desktop Protocol (RDP) is the primary access method for Windows VPS and dedicated servers. Secure configuration is mandatory.

3.1 How to Connect

Windows → Start → Run → mstsc
macOS → Microsoft Remote Desktop App (App Store)
Linux → Remmina / FreeRDP

3.2 RDP Credential Handling

• Never share the Administrator password via email or chat without encryption.
• Create separate RDP users if multiple staff require access.
• Enable auditing to track user login attempts.

3.3 RDP Security Enhancements

• Change default RDP port from 3389
• Whitelist trusted IP addresses only
• Enable brute-force protection via account lockout policy
• Implement strong password policies

4. Network Configuration

The network configuration for your Windows server is pre-set by iCoreHosting. Changing gateway or routing values without guidance may cause connectivity loss.

4.1 Verify Network Status

ipconfig /all

4.2 Recommended DNS

• Primary DNS: 8.8.8.8
• Secondary DNS: 1.1.1.1
• Optional: 9.9.9.9 (Security DNS)

4.3 Firewall Rules (Expanded)

Allow only required ports:

• TCP 3389 – RDP
• TCP 80/443 – IIS Web Hosting
• TCP 1433 – SQL Server (if required)
• TCP 587/25 – SMTP (low volume only)
• Custom ports – For application services

Always block unused ports to minimize surface area for attacks.

5. Nameservers & DNS Guidance

DNS is critical for Windows IIS hosting, SSL issuance, mail delivery, and API functionality. Incorrect DNS will break website and email operations.

5.1 Recommended iCoreHosting Nameservers

nscp1.icorehosting.com
nscp2.icorehosting.com

5.2 Basic DNS Records

• A → yourdomain.com → SERVER_IP
• A → www → SERVER_IP

5.3 Email DNS Requirements

• MX → your mail server
• SPF (TXT)
• DKIM (if external SMTP is used)
• DMARC for policy enforcement

5.4 PTR (Reverse DNS)

PTR is required for proper outgoing email reputation and must be set via iCoreHosting support.

6. Windows Server Roles Overview

Windows Server supports a wide range of roles. Only enable the roles you actually need to avoid performance loss and security exposure.

6.1 Commonly Required Roles

• IIS Web Server – Host ASP.NET, MVC, API apps
• .NET Framework / .NET Core Hosting Bundle
• Windows SMTP Server – Low volume application-based email
• Remote Desktop Services (RDS) – Multi-user login environment
• File Server Role – Enterprise storage for internal users

6.2 Roles to Avoid (Standalone Hosting Servers)

• Active Directory Domain Services
• DHCP Server
• Hyper-V Role
• Print Server

These roles are not suitable for general hosting use and may increase security exposure.

7. Security Baseline

Windows servers face high attack volume by default. Implementing a proper security baseline is mandatory before going into production.

7.1 RDP Hardening

• Change RDP port
• Enable NLA
• Set IP whitelist
• Configure account lockout policy

7.2 Windows Firewall

• Restrict inbound ports to only required services
• Enable firewall logging
• Disable NetBIOS and unnecessary protocols

7.3 Antivirus / Malware Protection

• Enable and update Windows Defender daily
• Schedule weekly full scan
• Optional: Install enterprise antivirus (ESET, Sophos, etc.)

7.4 System Hardening

• Disable Guest account
• Audit failed login attempts
• Disable SMBv1
• Remove unused Windows features

8. Local Government Rules Reminder

All servers hosted under iCoreHosting infrastructure must comply with Malaysian laws. Customers are fully responsible for any hosted data and activity.

8.1 Related Malaysian Acts

• Communications and Multimedia Act 1998 (CMA)
• Personal Data Protection Act (PDPA)
• Computer Crimes Act 1997
• Copyright Act

8.2 Strictly Prohibited Activities

• VPN, proxy, tunneling services without written approval
• Phishing, malware, hacking tools
• Spam or mass unsolicited email
• Illegal streaming, piracy, gambling
• Crypto-mining

9. System Updates & Patch Management

Windows Updates are essential to prevent vulnerabilities, ransomware, and operating system corruption.

9.1 Update Strategy

• Enable automatic updates
• Install critical and security updates monthly
• Schedule reboots outside business hours

9.2 Fix Failed Updates

sfc /scannow
DISM /Online /Cleanup-Image /RestoreHealth

9.3 Driver Updates Warning

Do NOT install driver/firmware updates unless instructed by iCoreHosting support.

10. Web Server, IIS, SMTP & Application Deployment

Windows Server supports a wide range of enterprise web and application workloads. IIS (Internet Information Services) provides a stable and high-performance environment for ASP.NET, MVC, .NET Core, and API-based applications.

10.1 IIS Web Server Setup

• Install IIS → Add Roles and Features → Web Server (IIS)
• Enable ASP.NET, CGI, URL Rewrite, WebSockets (if required)
• Configure Application Pools per site for isolation
• Use Integrated Pipeline for modern .NET applications
• Enable HTTPS for every site

10.2 .NET & Framework Requirements

Install only the frameworks your applications require:

• .NET Framework 4.8
• .NET Core / .NET Hosting Bundle
• Visual C++ Redistributables

10.3 SMTP & Email

Windows Server includes a lightweight SMTP server suitable only for application-generated transactional mail.

• Not recommended for general mailbox hosting
• Outbound emails should use SMTP smarthost (Amazon SES, Mailjet, Mailgun)
• Ensure SPF, DKIM, DMARC are configured on DNS
• PTR (reverse DNS) required for reliable delivery

11. Backup Policy (No Backup Included)

Windows VPS and Dedicated Server plans from iCoreHosting do not include any backups by default. All backup responsibilities fall entirely on the customer.

11.1 Optional Backup Solutions

• Windows Server Backup (local disk or external storage)
• Remote backup via SFTP, Rsync, or SMB
• Cloud storage (OneDrive, Google Drive, AWS S3, Wasabi)
• VPS snapshot backup (only on supported plans)

11.2 Customer Responsibilities

• Maintain multiple copies separate from the server
• Test restore procedures regularly
• Ensure enough disk space for backup creation
• Keep backup data encrypted and protected

12. Sub-Hosting / Multi-User Responsibility

If your Windows server is used to host multiple users, multiple RDP accounts, or multiple client applications, you are fully responsible for the behaviour of all downstream users.

12.1 Sub-Hosting Requirements

• Create a separate Windows user account for each person
• Never share the Administrator password
• Apply per-user folder permissions
• Disable unneeded user accounts immediately

12.2 Abuse & Enforcement

• RDP brute-force attacks caused by weak user passwords
• Unauthorized software installed by sub-users
• Email spam or compromised user accounts
• Misuse of SMTP relay services

12.3 Sub-Hosting Best Practices

• Use Group Policy to restrict non-admin users
• Restrict installation rights for all standard users
• Monitor login logs for abnormal access
• Enable per-user disk quotas when needed

13. Monitoring & Logs

Windows provides extensive logging tools for performance, stability, and security analysis. Monitoring your server helps detect issues early.

13.1 Critical Log Locations

• Event Viewer → System – System warnings & errors
• Event Viewer → Security – Login attempts & failures
• IIS Logs – Website requests & errors
• Windows Defender logs – Malware detection

13.2 Real-Time Monitoring Tools

• Task Manager – Basic CPU, RAM, disk monitoring
• Resource Monitor – Deeper process inspection
• Performance Monitor – Long-term tracking
• netstat – Active connections

14. Performance Optimization

14.1 System-Level Optimization

• Enable SSD TRIM (if supported)
• Disable unnecessary startup services
• Allocate sufficient page file size for workloads
• Disable animations & visual effects

14.2 IIS Optimization

• Enable output caching
• Enable HTTP/2
• Enable compression (GZIP/Brotli)
• Use isolated application pools

14.3 Application Performance

• Use CDN for static content
• Optimize database queries
• Clear application logs regularly

15. Advanced Security Hardening

15.1 RDP Hardening (Expanded)

• Change RDP port
• Allow only whitelisted IPs
• Enable NLA
• Disable clipboard sharing (optional)
• Disable drive mapping (optional)

15.2 Password & Account Policies

• Minimum password length: 12–16 characters
• Password expiry: every 90–180 days
• Account lockout after 3–5 attempts

15.3 Windows Firewall Hardening

• Block all unused ports
• Enable logging for dropped packets
• Disable SMBv1
• Disable LLMNR & NetBIOS

15.4 Antivirus & Malware Defense

• Update Windows Defender signatures daily
• Schedule full malware scans weekly
• Use enterprise antivirus if storing sensitive data

16. Storage, File Count & Quota Management

Windows servers do not use Linux inodes, but file count and directory complexity directly affect performance and indexing speed.

16.1 Check Disk Utilization

Get-PSDrive

16.2 Common Causes of Storage Problems

• Windows Update cache bloat
• Large IIS logs
• RDP user profile accumulation
• Application log files
• Database growth (SQL Server)

16.3 Prevent Storage Issues

• Enable storage sense
• Move logs to secondary disk
• Clear temp files regularly
• Monitor SQL database size
• Use quotas for multi-user environments

17. Common Misconfigurations

17.1 DNS Errors

• Incorrect A record
• Missing MX/SPF/DKIM/DMARC
• PTR not matching hostname

17.2 Security Mistakes

• Leaving RDP on default port
• Weak Administrator passwords
• Allowing all IPs to access RDP
• Disabling antivirus

17.3 Application Misconfigurations

• Incorrect IIS binding
• Missing HTTPS redirect
• Wrong .NET version assigned to application
• SQL Server exposed to public internet

18. Responsibility Breakdown

18.1 iCoreHosting Responsibilities

• Datacenter power, cooling & physical security
• Network routing & upstream connectivity
• Hardware replacement for dedicated servers
• Hypervisor stability for VPS
• Basic IP address allocation

18.2 Customer Responsibilities

• Windows OS updates & system patching
• RDP & firewall hardening
• Data backups & disaster recovery
• Application performance & code stability
• Email anti-spam compliance
• DNS record management
• Compliance with Malaysian laws (CMA, PDPA, etc.)
• Sub-user & multi-user abuse prevention

18.3 What is Not Included

• Application debugging or development
• Email deliverability tuning
• Data recovery without backup plan
• Cleaning malware caused by outdated system patches
• Support for illegal or high-risk services

19. Support Information

• Support: https://www.icore.com.my/support
• Billing: https://billing.icore.com.my

Information Required for Support Tickets

• Server IP / Hostname
• Description of issue
• Error message or screenshot
• Steps taken so far
• Time issue occurred

iCoreHosting – Windows VPS / Dedicated Server Onboarding & Security Hardening Guide • Version 5 Expanded Edition