Windows Server on a VPS: licensing, RDP and what you actually get

The first thing any experienced sysadmin checks before provisioning a Windows Server VPS is the licensing. On a Linux VPS the OS costs nothing. On Windows Server the licensing model is different, and if you do not understand it before you buy, you will be surprised at renewal time. This article covers exactly how Windows Server licensing works when you rent a VPS, what the RDP experience looks like on a remote server, and what you actually get on a Vietnam-based Windows VPS from a local provider like thueVPS, not a cloud hyperscaler.

Prerequisites

• A Windows Server VPS provisioned and running, any edition (Standard or Datacenter).
• RDP client installed on your local machine (Remote Desktop Connection on Windows, Microsoft Remote Desktop on macOS, or FreeRDP/Remmina on Linux).
• Administrator password provided by your hosting provider.
• Familiarity with basic Windows administration: Server Manager, Event Viewer, firewall rules.

Why licensing is the real cost of a Windows VPS

When you buy a Windows Server VPS, you are not just paying for the virtual hardware, you are also paying for the OS license. Windows Server is not free. Microsoft licenses it through the Service Provider License Agreement (SPLA) model, which is the only licensing path that allows a hosting provider to offer Windows Server to third parties on a monthly basis.

Under SPLA, the provider (not you) holds the license and pays Microsoft a monthly fee for each virtual core assigned to your VPS. That cost is passed to you as part of the monthly price. This is the key difference from buying a perpetual license: there is no one-time purchase, no downgrade rights to transfer, and you cannot bring your own retail or volume license to a shared hosting environment. Some providers may allow you to use your own license under dedicated hosting terms, but with a typical VPS, SPLA is the default.

The per-core monthly SPLA cost from Microsoft is roughly $10, $15 per core depending on the edition and the provider's agreement tier. A 2-core VPS therefore carries an estimated $20, $30 monthly licensing cost added to the base virtualization price. This is why a Windows VPS almost always costs more than an equivalent Linux VPS, the OS license is priced per core, per month.

When comparing offers from different Vietnam providers, ask directly if the price includes the Windows Server license under SPLA. Some providers advertise a low base price and add the license as a separate line item. Others bundle it. Still others may be running evaluation editions that expire after 180 days, a trap that catches companies that do not check the license status after the first six months.

Windows Server VPS 许可证按每核心每月付费，且不允许自带零售授权。

Windows Server VPS licensing is paid per core per month, and you cannot bring your own retail license.

Step 1, RDP: the protocol and what to expect

Remote Desktop Protocol (RDP) is how you connect to a Windows Server VPS. Out of the box the VPS will have RDP enabled on port 3389. Your first connection is with the built-in Administrator account. The default setup from most Vietnam providers, including thueVPS, works the same way as any other hosting service: you receive an IP address, a username (Administrator), and a password.

Connect using your local RDP client:

# On Windows: Windows Key + R, type mstsc, enter IP and credentials.
# On macOS: Microsoft Remote Desktop app, add PC, paste IP.
# On Linux:
xfreerdp /v:203.0.113.10 /u:Administrator /p:YourPassword /dynamic-resolution

What you actually get on the connection: RDP uses a single TCP connection (port 3389) encrypted by TLS by default since Windows Server 2016. On a Vietnam VPS, the latency between your local machine and the Vietnam datacenter depends entirely on your location. If you are in East Asia, Hong Kong, Singapore, Japan, expect latency between 30ms and 80ms. From Europe or the US, expect 150ms, 250ms. At 150ms or below, remote desktop is perfectly usable for administration (Server Manager, PowerShell, file operations). Above 200ms the experience becomes sluggish for GUI-heavy tasks.

Important: Do not confuse RDP with graphical workstations. A Windows Server VPS has no GPU acceleration. You are running on a virtual CPU with emulated display. RDP at 250ms from Europe is usable for checking logs, running a script, or editing a configuration file, it is not a replacement for local interactive work.

Step 2, Securing the RDP port

Port 3389 is a prime target for brute force attacks. On a fresh Windows VPS this port is exposed to the public internet. The first thing you must do is secure it.

Option A: Change the RDP port

Edit the registry at HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp, change PortNumber from 3389 (decimal) to a high port like 33456, then restart the service:

# PowerShell as Administrator
New-NetFirewallRule -DisplayName "RDP-HighPort" -Direction Inbound -Protocol TCP -LocalPort 33456 -Action Allow
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" -Name "PortNumber" -Value 33456
Restart-Service TermService -Force

Then connect using IP:33456 in your RDP client.

Option B: Windows Firewall, restrict source IPs

If you connect from a static IP address, limit RDP access to that single source:

# Remove the default rule and create a scoped one
Remove-NetFirewallRule -DisplayName "Remote Desktop*"
New-NetFirewallRule -DisplayName "RDP-From-Office" -Direction Inbound -Protocol TCP -LocalPort 3389 -RemoteAddress 203.0.113.50 -Action Allow

Option C: RDP gateway or VPN

The cleanest security model is to not expose RDP at all. Install WireGuard or OpenVPN on your Windows VPS (or use a separate Linux jump host), and connect RDP only over the encrypted tunnel. This eliminates port scanning entirely.

Verify your configuration:

After any change, test that the firewall allows the new port from your source, and block all other inbound 3389 traffic:

# Check listening ports
netstat -ano | findstr :3389
# Should show nothing if you changed the port
# Check your custom port
netstat -ano | findstr :33456

Step 3, What you actually get: bandwidth, storage, and performance

Let us be specific about what a Vietnam-based Windows VPS delivers in real terms. Using thueVPS as a representative example of a local provider:

How to interpret these numbers: This is a Windows VPS optimized for users in or serving Vietnam. The domestic bandwidth (100 Mbps) is fast enough to run an ERP dashboard for a Ho Chi Minh City office, push nightly database backups to a local storage server, or serve a website to Vietnamese users with low latency. The international pipe (4 to 10 Mbps shared) is enough for remote administration from anywhere in the world, RDP, PowerShell remoting, file transfers, but it is not a fast internet connection for the server to download large files from US or European servers. Plan for that: if your application needs to sync data from a cloud service in the US, expect the transfer to take significantly longer than a local Vietnamese connection.

Where it shines: Any workload that serves Vietnamese users. A Windows VPS with a Vietnam IPv4 means your customers connect over domestic routes, no international bottleneck. An accounting system (MISA, SAP Business One), a .NET web application, a Windows-based license server for a local engineering firm, these are the workloads this VPS is built for. It is not built for international SaaS with users on five continents.

Step 4, Common pitfalls and how to avoid them

1. Running out of disk space on the root partition (C:\). Unlike a Linux VPS where you can often add a mounted volume quickly, resizing a Windows partition requires downtime. Check your plan size and monitor free space. If your application logs grow fast, configure Windows Event Log size limits or redirect logs to a separate disk.

2. Using an expired evaluation edition. If your provider does not use SPLA, verify the Windows license status. Run slmgr /dli to see if the OS is activated and the license type. If it says "Evaluation" with an expiry date, you have 180 days before the server shuts down.

3. RDP disconnects due to idle timeout. By default Windows Server disconnects idle RDP sessions after a period (often 15 minutes with no mouse/keyboard). If you run long scripts remotely, increase the timeout or use PowerShell WinRM instead:

# Set RDP idle timeout to 4 hours (14400 seconds)
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" -Name "MaxIdleTime" -Value 14400

4. Misunderstanding the international bandwidth cap. The international pool is shared. Between 7 PM and 11 PM Vietnam time (UTC+7) it will be slower due to peak domestic usage. Schedule your Windows Updates and large downloads for early morning Vietnam time (3 AM, 7 AM).

FAQ

Related articles

• Migrating a legacy .NET app to a Windows VPS
• Securing RDP on a public IP, the four settings that matter
• Windows Server vs Linux for a small business VPS
• Sizing RAM for Windows Server VPS, why 2 GB is never enough