Harden Windows Server 2022 on a Public IPv4

A Windows Server 2022 VPS with a public IPv4 is reachable the moment the guest gets an address. Scanners will fingerprint 3389, 445, 5985, and 80 within minutes. Hardening is not a CIS spreadsheet you fill in later. It is the first hour of work: close what you do not serve, patch what you do, and make sure a guessed password cannot become a desktop session.

You are on Intel Xeon Platinum with High-Speed SSD and L3/L4 DDoS filtering in Lucknow. That protects the path from volumetric junk. It does not disable SMBv1, it does not turn on NLA, and it does not uninstall roles you will never use. Those are guest configuration. Do them before you publish an app.

First hour: identity, RDP, and the obvious ports

Create a dedicated local admin, confirm you can RDP as that user, then stop using a well-known account name for daily work. Enable NLA. Scope the Remote Desktop firewall group to your office or jump host. Disable SMBv1. Confirm that 445, 135, and WinRM are not reachable from the internet unless you have a written reason.

New-LocalUser -Name 'opsadmin' -Password (Read-Host -AsSecureString 'opsadmin password') -PasswordNeverExpires
Add-LocalGroupMember -Group 'Administrators' -Member 'opsadmin'
Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name UserAuthentication -Value 1
Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol -NoRestart
Get-NetFirewallRule -Direction Inbound | Where-Object { $_.Enabled -eq 'True' } | Format-Table DisplayName, Profile, Direction, Action
Set-NetFirewallRule -DisplayGroup 'Remote Desktop' -RemoteAddress 203.0.113.10
Set-NetFirewallRule -DisplayName 'Windows Remote Management (HTTP-In)' -Enabled False

Replace 203.0.113.10 with your real admin prefix. Keep a console session open. If WinRM is how you automate, do not disable the rule; scope it the same way you scoped RDP. Public WinRM on 5985 without TLS is worse than public RDP.

Remove software you will not serve

Server 2022 with Desktop Experience ships convenience features that are attack surface on a VPS. Print Spooler is the classic example: unless this box is a print server, stop it and disable it. Fax, XPS, SMB 1.0, Telnet, and TFTP do not belong on an internet-facing guest. IIS, FTP, and SMTP should be absent until an application needs them.

Stop-Service -Name Spooler -Force
Set-Service -Name Spooler -StartupType Disabled
Get-WindowsFeature | Where-Object { $_.InstallState -eq 'Installed' } | Format-Table Name, DisplayName
Uninstall-WindowsFeature -Name Telnet-Client, TFTP-Client -ErrorAction SilentlyContinue
Get-Service | Where-Object { $_.Name -match 'Fax|Xbl|WSearch' } | ForEach-Object { Set-Service $_.Name -StartupType Disabled; Stop-Service $_.Name -ErrorAction SilentlyContinue }
Get-NetTCPConnection -State Listen | Select-Object LocalAddress, LocalPort, OwningProcess | Sort-Object LocalPort

Read the listen table. Anything bound to 0.0.0.0 that you cannot name should be disabled or firewalled. 3389 and later 80/443 for IIS are the usual exceptions. 445 should not face the internet on a single VPS. File sharing belongs on a scoped rule, covered in a later post.

Patch, Defender, and TLS defaults

Install current cumulative updates before the box is famous. Windows Defender should remain on; do not uninstall it to "save RAM" on a public IPv4. TLS 1.0 and 1.1 should be off for IIS and WinRM once you confirm clients are modern. Local account lockout belongs in the same pass: five failed logons, a 15-minute lock, and a window that is long enough to blunt spraying without locking you out of your own box.

Use Windows Update from an elevated session, reboot in a window you chose, then confirm Get-HotFix shows a recent KB. Enable the firewall on Domain, Private, and Public profiles. A VPS on a public IPv4 is a Public profile more often than people expect. Setting DefaultInboundAction to Block and then adding explicit allow rules is the correct posture.

Audit so you can tell when guessing starts

Enable failure auditing for logon and account lockout. Ship Security event 4625 somewhere you will actually look, even if that is a scheduled task that emails a count. If you never look at Event Viewer, hardening is theatre. A public Windows VPS that is quiet in Security logs is either well scoped or not receiving traffic, which usually means the firewall rule is doing its job.

Do not expose LDAP, RDP web client extras, or Remote Assistance. Do not domain-join a singleton VPS to a lab AD across the internet. If you need AD, put it on a private network and treat the public Windows box as a member that only serves HTTP.

Takeaway

Harden before you publish: dedicated admin, NLA, scoped RDP, no SMBv1, Spooler off unless you print, Defender on, and a listen table you can explain. You can boot Windows Server 2022 on Netbay in Lucknow and finish this first hour on a public IPv4 before the scanners get a useful sample, starting at netbayhosts.in.