Set-NetFirewallRule -DisplayGroup "Remote Desktop" -RemoteAddress 203.0.113.25. The strongest option is to not expose RDP at all and connect through a VPN or RD Gateway.
Before you start
- A brute-force attack is a bot trying thousands of passwords against your Remote Desktop port (TCP 3389 by default). Every internet-facing RDP server sees them.
- Check whether you are being targeted: see failed login attempts (event ID 4625).
- Some steps below can lock you out of RDP. On a VPS, make sure you can sign in with the VNC console first. On a dedicated server, open a ticket if you need console (KVM/IPMI) access.
Which protections should I use?
Use as many layers as you can. Microsoft’s own options, from easiest to strongest:1. Use strong passwords on every account
Every account that can use Remote Desktop needs a long, unique password (16+ characters from a password manager). Bots tryAdministrator and common names first. See change the Administrator password. Remove accounts you don’t use from Remote Desktop Users.
2. Set an Account Lockout Policy
An account lockout policy locks an account for a while after too many wrong passwords. Microsoft’s baseline recommendation is 10/10/10: lock after 10 failed attempts, count attempts over 10 minutes, and lock for 10 minutes (KB5020282).1
Open Local Security Policy
Press Win+R, type
secpol.msc and press Enter.2
Go to the lockout settings
Open Security Settings > Account Policies > Account Lockout Policy.
3
Set the three values
Set Account lockout threshold to
10, then Account lockout duration and Reset account lockout counter after to 10 minutes. The lockout duration must be greater than or equal to the reset counter.4
Decide on the Administrator account
The policy Allow Administrator account lockout in the same folder controls whether the built-in Administrator can be locked out. Microsoft added it in the October 2022 updates and enables it by default only on computers set up with those updates.
3. Keep Network Level Authentication on
Network Level Authentication (NLA) makes users authenticate before a Remote Desktop session is created, which reduces the load and risk from unauthenticated connections. To check it, runSConfig, choose 7 (Remote desktop), then E (enable) and 1 (Network level authentication, the more secure choice).
4. Limit RDP to your own IP addresses
If you connect from a fixed IP address (home, office or another server), tell Windows Firewall to accept RDP only from it. Find your current public IP from a site such as your router’s status page or a “what is my IP” search.1
Check the current Remote Desktop rules
2
Limit them to your addresses
3
Test before you sign out
Keep your current session open and start a new Remote Desktop connection. If it works, you are done.
Set-NetFirewallRule -DisplayName "..." -RemoteAddress ... on that rule. To undo, set -RemoteAddress Any.
Network-level option: if your server’s IP is protected by our Firewall Panel and its provider supports IP lists, you can also whitelist your addresses in an IP list and use it in a DDoS filter. Keep the Windows Firewall limit as well.
5. Put RDP behind a VPN
With a VPN, RDP is reachable only through an encrypted tunnel, so bots on the internet never see it. Set up WireGuard on Windows Server, connect the tunnel, then limit the Remote Desktop rules to the VPN subnet:10.8.0.1) before you apply the limit.
6. Use RD Gateway for larger setups
Remote Desktop Gateway is a Windows Server role that carries RDP inside an encrypted SSL tunnel. It authenticates users first, supports connection and resource authorisation policies (RD CAP and RD RAP), and can use RADIUS for multi-factor authentication. It needs a publicly trusted certificate and more setup, so it suits teams rather than one admin. See Microsoft’s Remote Desktop Services access from anywhere.How to check it worked
- secpol.msc > Account Policies > Account Lockout Policy shows your three values.
- From an IP that is not in your list,
Test-NetConnection 203.0.113.10 -Port 3389showsTcpTestSucceeded : False; from your own IP it showsTrue. - After a day, the count of event ID 4625 failures should drop sharply.
Frequently asked questions
Does changing the RDP port stop brute-force attacks?
It cuts down automated noise, because many bots only try port 3389, but scanners find other ports too. Treat it as an extra, not a replacement for the steps above. See change the RDP port.Is there a built-in tool like fail2ban for Windows?
The controls Microsoft documents for this are the account lockout policy and firewall rules limited by source IP. Limiting by IP blocks the bots completely, which is stronger than banning addresses one by one after they have already tried.What happens if the Administrator account gets locked out?
You must wait for the lockout duration to end, or sign in with another administrator account and unlock it. That is why you should keep a second admin account and console access.Can I use multi-factor authentication for RDP?
Microsoft documents MFA for Remote Desktop through RD Gateway, which can use RADIUS-based MFA solutions. A VPN with key-based authentication also adds a second barrier in front of the password.Related guides
VPS and dedicated server guides
Every guide in this section.
See failed login attempts
Event ID 4625 explained.
Set up a VPN on Windows Server
WireGuard in front of RDP.
Windows Server security checklist
Every hardening step.
Change the RDP port
Move RDP off 3389.
Firewall Panel IP lists
Whitelist your addresses at the network edge.
Checked against Microsoft Learn and Microsoft Support: Account lockout threshold, KB5020282, SConfig, Configure firewall rules with PowerShell and RDS access from anywhere on 4 November 2026. Steps were not tested on a live Windows server for this page; menu names can differ slightly between Windows Server 2019, 2022 and 2025.
Need Extra Help?
If you encounter any issues, our support team is ready to assist:- Live Chat: Quick assistance via our website.
- Support Ticket: Open a Ticket
- Discord: Join our Community
- Email: support@freakhosting.com
Last Updated: November 2026