PowerShell Essentials for Day-2 Windows VPS Admin

Day-2 on a Windows VPS is not Server Manager. It is PowerShell: what is listening, what failed overnight, which service is stopped that should be automatic, how full the High-Speed SSD is, and whether last night's cumulative update is waiting for a reboot. If you only know the GUI, you will RDP for every disk-full alert. If you know a short cmdlet set, you can script the same checks from a jump host and keep RDP for the exceptions.

This is not a language tour. It is the operator loop you run after the guest is live: inventory, health, logs, tasks, and a safe restart. Run it in an elevated prompt. Prefer Windows PowerShell 5.1 on Server 2022 unless you have already installed PowerShell 7 side by side.

Inventory the guest before you change it

Start every session with facts. Hostname, last boot, RAM, disk, hotfixes, listening ports. If you cannot print those, you should not be editing IIS bindings.

$os = Get-CimInstance Win32_OperatingSystem
$os | Select-Object Caption, Version, LastBootUpTime
Get-CimInstance Win32_ComputerSystem | Select-Object Name, NumberOfLogicalProcessors, TotalPhysicalMemory
Get-PSDrive -PSProvider FileSystem | Select-Object Name, @{N='UsedGB';E={[math]::Round(($_.Used/1GB),2)}}, @{N='FreeGB';E={[math]::Round(($_.Free/1GB),2)}}
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 8 HotFixID, Description, InstalledOn
Get-NetTCPConnection -State Listen | Select-Object LocalAddress, LocalPort, OwningProcess | Sort-Object LocalPort
Get-Process -Id (Get-NetTCPConnection -State Listen).OwningProcess -ErrorAction SilentlyContinue | Select-Object Id, ProcessName -Unique

Calculated properties use a hashtable with N and E keys. That is not a template literal; it is how PowerShell names a column. Watch FreeGB on C:. IIS logs, crash dumps, and Windows Update downloads fill a small VPS disk quietly.

Services, restarts, and the automatic-but-stopped trap

A production Windows VPS should have a known set of Automatic services in the Running state. W3SVC, your .NET Windows service, and any vendor agent belong on that list. Spooler, if you disabled it during hardening, should stay Stopped and Disabled.

Get-Service | Where-Object { $_.StartType -eq 'Automatic' -and $_.Status -ne 'Running' } | Format-Table Name, Status, StartType
Get-Service W3SVC, WAS -ErrorAction SilentlyContinue | Format-Table Name, Status, StartType
Restart-Service -Name W3SVC -Force
Get-WinEvent -FilterHashtable @{ LogName = 'System'; Level = 2; StartTime = (Get-Date).AddHours(-24) } |
  Select-Object TimeCreated, ProviderName, Id, Message -First 20
Get-WinEvent -FilterHashtable @{ LogName = 'Application'; Level = 2; StartTime = (Get-Date).AddHours(-24) } |
  Select-Object TimeCreated, ProviderName, Id -First 20
Get-ScheduledTask | Where-Object { $_.State -eq 'Ready' } | Select-Object TaskName, TaskPath

Get-WinEvent with FilterHashtable is faster than Get-EventLog on Server 2022. Level 2 is Error. If Application is full of IIS 500s, fix the site before you chase CPU. If System is full of disk warnings, you are already late.

Day-2 chores you should script, not click

Three recurring jobs belong in Scheduled Tasks, not in your memory.

• A daily disk and Automatic-service report written to C:\logs\health.txt.
• A weekly Get-HotFix snapshot so you can see when patching stopped.
• A log trim for IIS and your app if you are not shipping events off-box.

Register-ScheduledTask with a SYSTEM principal and a time you will actually tolerate. Do not store passwords in the task if SYSTEM can do the work. Do not run unknown downloaded .ps1 files from the internet without reading them. Execution policy is not a security boundary; it is a seatbelt. Set RemoteSigned on a VPS you control, sign nothing, and keep scripts in C:\tools where only Administrators can write.

When you must reboot, tell people, drain IIS if you can, then Restart-Computer -Wait is for remote WinRM, not for the box you are sitting on in RDP. From RDP, schedule shutdown /r /t 60 and disconnect. Confirm after boot with LastBootUpTime.

Remote PowerShell without opening the world

WinRM is useful from a jump host. It is dangerous on 5985/5986 from 0.0.0.0/0. Enable it only if you will scope the firewall like RDP. From the jump host, Enter-PSSession -ComputerName with a trusted HTTPS listener is the grown-up form. For a single VPS, RDP plus local PowerShell is enough and one less port.

Keep a small operator notebook in C:\tools\day2.ps1 that prints disk, Automatic services that are not Running, and the last ten Error events. Run it at the start of every RDP session. The first week you will catch a stopped W3SVC or a filling C: volume before customers do. After that, the same script is what you hang off a scheduled task. Intel Xeon Platinum does not help if the guest is out of disk or the worker service is Stopped.

Takeaway

Learn a small loop: inventory, Automatic services, Get-WinEvent, then act. Script the daily report and keep RDP for work that actually needs a desktop. Provision a Windows VPS on Netbay in Lucknow and run these cmdlets on Intel Xeon Platinum with High-Speed SSD from a clean guest at netbayhosts.in.