Local Security Policy is where a standalone Windows server keeps its core security rules: how strong passwords must be, when accounts lock, who may sign in over Remote Desktop, and what gets logged. This guide walks through the parts you are most likely to use, explains what is safe to change, and shows how to back up the settings before you touch them.
Before you start
- Administrator access over Remote Desktop to
203.0.113.10:3389. - The browser console in your VPS provider's control panel as a fallback. Some settings here can block your own sign-in.
- A Pro, Enterprise or Server edition of Windows. Home editions do not include
secpol.msc.
Note: On a domain-joined machine, domain Group Policy overrides these local settings. servers are standalone by default, so local policy applies.
Open Local Security Policy
Press Win + R, type secpol.msc and press Enter. You can also find it under Tools in Server Manager.
The left pane has several sections. The ones that matter most on a remote server are Account Policies, Local Policies and, for advanced logging, Advanced Audit Policy Configuration.
Back up the current settings first
Before you change anything, export the current policy to a file. Open PowerShell or Command Prompt as Administrator:
mkdir C:\PolicyBackup
secedit /export /cfg C:\PolicyBackup\secpol-before.infThe .inf file is plain text. You can open it in Notepad to read every setting by name. Keep a copy off the server too.
Account Policies
Password Policy
Controls the rules for local account passwords:
- Minimum password length and Password must meet complexity requirements.
- Enforce password history, so people cannot reuse recent passwords.
- Maximum password age and Minimum password age.
See Set a strong password policy on Windows Server for recommended values.
Account Lockout Policy
Locks an account after a number of failed sign-ins:
- Account lockout threshold, Account lockout duration and Reset account lockout counter after.
This is one of the best defences against Remote Desktop password guessing. See Set an account lockout policy against RDP password guessing.
Local Policies
Audit Policy
Decides which security events Windows records in the Security log. The most useful one on a remote server is Audit logon events, set to both Success and Failure. That lets you see who signed in and which attempts failed.
On modern Windows, the more detailed Advanced Audit Policy Configuration section replaces these basic settings. If you use advanced audit policy, do not mix it with the basic one. To see what is actually applied, run:
auditpol /get /category:"Logon/Logoff"User Rights Assignment
Lists rights such as Allow log on through Remote Desktop Services, Deny log on through Remote Desktop Services, Shut down the system and Change the system time. Each right lists the users and groups that have it.
Warning: A Deny right always wins over an Allow right. Adding Administrators or Everyone to a deny right will lock you out of Remote Desktop. See Allow log on through Remote Desktop: user rights explained before changing these.
Security Options
A long list of individual settings. Useful ones include:
- Accounts: Rename administrator account: rename the built-in admin.
- Interactive logon: Do not display last signed-in: hides the last username on the login screen.
- Interactive logon: Machine inactivity limit: locks the screen after a period of no input.
- Network security: LAN Manager authentication level: controls old authentication protocols. Leave the default unless you know you need a change.
Each setting has an Explain tab when you double-click it. Read it before changing anything.
Apply and check changes
Changes made in secpol.msc usually apply within moments. To force a refresh:
gpupdate /forceTo check what is in effect, export again and compare with your backup:
secedit /export /cfg C:\PolicyBackup\secpol-after.inf
fc C:\PolicyBackup\secpol-before.inf C:\PolicyBackup\secpol-after.inffc lists the lines that differ.
Restore a backup
If a change causes problems, you can re-apply the exported settings:
secedit /configure /db C:\PolicyBackup\restore.sdb /cfg C:\PolicyBackup\secpol-before.inf /areas SECURITYPOLICY USER_RIGHTS/areas limits the restore to account and local policies and user rights. Restart or run gpupdate /force afterwards.
Warning: Only restore a file exported from this server. Applying policy from another machine can include user rights for accounts that do not exist here and may remove your access.
Check it works
After a change, confirm it in two ways:
- Reopen the setting in
secpol.mscand check the value. - Test the effect. For example, after changing user rights, open a new Remote Desktop session to
203.0.113.10:3389while your current one stays open.
Troubleshooting
- A setting is greyed out: a higher-level policy controls it. Run
gpresult /rto see which policies apply. - "Windows cannot find secpol.msc": you are on a Home edition. Upgrade the edition or use
net accountsfor password and lockout settings. - Locked out of RDP after a change: sign in through the browser console in your VPS provider's control panel and undo the change, or restore your backup with
secedit. - Audit events missing: advanced audit policy may be overriding the basic setting. Check with
auditpol /get /category:*.
Next steps
- Related editor for non-security settings: Local Group Policy Editor basics.
- Record logons properly: Audit policy for logon events.