Windows on Lightsail: secure remote desktop and backups

Not everything that goes to the cloud is Linux. A management program that only runs on Windows, a SQL Server database, a desktop so that two people can work from home with the same program: for that, Lightsail offers Windows Server machines with a fixed monthly price, licence included, and a console that does not force you to know about networking.

The difference from a Linux machine is how you get in: instead of a terminal, a remote desktop (RDP), with screen, mouse and keyboard as if you were in front of it. And that is where the danger lies: a Windows machine with remote desktop open to the whole internet receives thousands of password attempts a day from the first minute. This guide creates the machine, connects you from Windows and from Mac, closes the door so that only you can get in and finishes with updates, backups and which part of the price is licence.

Step by step

1. Create the Windows machine

   In the Lightsail console, click Create instance. Choose the nearby region (for Spain, Paris or Ireland). Under platform, select Microsoft Windows. In the blueprints you will see OS Only with Windows Server (2022 and 2025, depending on the region) and Apps + OS with SQL Server already installed. For an application server or a shared desktop, the most recent Windows Server under OS Only.

   Choose the plan. Windows needs more than Linux: for normal use, one with 4 GB of memory is the comfortable minimum; with SQL Server, 8 GB. Prices are higher than for Linux of the same size: that is the licence (we explain it at the end). Give it a name (gestion-oficina) and click Create instance. Windows takes a while to be ready: allow ten minutes before you can log in.

2. Get the administrator password

   Click the machine and go to the Connect tab. At the bottom there is a section with the user (Administrator) and a Show default password button (or "Retrieve default password"). Lightsail generates it when creating the machine and decrypts it with your account's key, so you do not have to download anything. If the button says it is not available yet, Windows is still installing: wait a few minutes and reload.

   Save it in a password manager, not on paper or in an email. It is temporary: you will change it in step 5. Before going on, in the Networking tab, Create static IP and attach it to the machine. Otherwise the IP changes on restart and your saved connection will stop working.

3. Connect by remote desktop from Windows or Mac

   The quickest way to try it is the Connect using RDP button in the console itself: it opens a desktop inside the browser. It will do in a pinch, but it is slow and does not copy files well. To work, use a real client:

   • From Windows: click Start, type Remote Desktop Connection (or mstsc) and open it. In "Computer" paste the static IP, click Show Options and in "User name" type Administrator. Save the connection with Save As. When connecting it will warn that the certificate is not trusted: that is normal on a new machine, accept. Paste the password.
   • From Mac: install Microsoft's Windows App from the App Store (the former Microsoft Remote Desktop). Click +, Add PC, type the static IP and create a user account with Administrator and the password. Double-click to connect; accept the certificate warning.

   If you see a timeout error, it is the firewall: check it under Networking. If you get in, Windows opens Server Manager; you can close it.

4. Close 3389 to everyone except you

   This is the step almost nobody takes and the one that prevents the most problems. Go to the machine's Networking tab, IPv4 Firewall section. You will see the RDP rule, port 3389, with source "Any IPv4 address". Click the pencil to edit it, tick Restrict to IP address and type your public IP (you can see it by searching "what is my IP" in the browser). You can add several: the office, your home. Leave the allow Lightsail browser RDP client box ticked, so you can get in from the console if one day your IP changes and you are locked out. Save.

   Do the same with the IPv6 rule if there is one. The HTTP (80) and HTTPS (443) rules should only exist if the machine serves a website; if not, delete them.

   Never leave 3389 open to everyone "just for a while": password attempts start within minutes and do not stop. If your IP changes often (home fibre without a fixed IP), edit the rule when it changes; the robust option is a VPN, which is another topic.

5. Change the password and create another user

   Inside the remote desktop, press Ctrl + Alt + End (the equivalent of Ctrl + Alt + Del in a remote session) and choose Change a password. Set a long one, generated by your password manager. From that moment on, Lightsail's "Show default password" button is no longer valid: keep it safe.

   Now a user for working. Click Start, type Computer Management, open Local Users and Groups, Users, right-click, New User. Name (maria), password, and create. Then right-click the user, Properties, Member Of tab, Add and type Remote Desktop Users; without that group they will not be able to connect. If they need to install programs, add them to Administrators too; otherwise, better not. Every person should have their own user: sharing Administrator is the easiest way to never know who did what.

6. Keep Windows updated

   Lightsail does not update Windows for you. Click Start, Settings, Windows Update, Check for updates. The first time there will be many; install and restart (the machine comes back on its own in a couple of minutes and the static IP does not change). Then leave it on automatic with the active hours set so it does not restart in the middle of the working day: in Windows Update, Advanced options, Active hours. And before any big update, the next step.

7. Schedule the snapshots

   The machine's Snapshots tab. Click Create snapshot to have one now that everything works and is clean; give it a name that says what it is (gestion-limpio-2026-10). Then enable automatic snapshots and choose a time in the small hours in your time zone. Lightsail keeps the last seven and deletes the earlier ones; manual ones are not deleted on their own.

   Snapshots are taken with the machine on. If you have SQL Server or another database, also take backups from the program itself: a snapshot in the middle of a write can leave the database in a state that needs repairing. To restore, on the snapshot click Create new instance, choose the same plan or a bigger one, move the static IP to it and delete the broken machine. They are charged by the space they take up, in GB per month; little compared with the machine.

What about the licences in the price

A Windows machine in Lightsail costs quite a bit more than a Linux one of the same size. The difference is the Windows Server licence, which AWS includes in the plan: you do not have to buy it, activate it or renew it, and it is legal to use it for whatever you like while the machine exists. The same goes for the SQL Server blueprints: the Express editions are free and cost the same as the machine; Standard and Web include the licence and the price goes up noticeably.

What is not included are the remote desktop access licences for several users (the RDS CALs). Windows Server allows two administrative sessions at once with nothing more; if you want five people working at the same time on the same machine, you need your own CALs, which are bought from Microsoft or a reseller. For one or two people who log in in turns, nothing is needed.

As with any Lightsail machine, the price is per monthly bundle and is charged while the machine exists, on or stopped. Stopping a Windows machine at night does not save money; deleting it with a snapshot taken does.

What can go wrong