> ## Documentation Index
> Fetch the complete documentation index at: https://help.freakhosting.com/llms.txt
> Use this file to discover all available pages before exploring further.

# How to Protect RDP from Brute-Force Attacks on Windows Server

> RDP brute force protection on Windows Server: strong passwords, account lockout policy, NLA, firewall limits by source IP, and a VPN or RD Gateway in front of RDP.

To protect Remote Desktop (RDP) from brute-force attacks on Windows Server, use long unique passwords, set an **Account Lockout Policy** (for example 10 attempts, 10 minutes), keep **Network Level Authentication** on, and limit the Remote Desktop firewall rules to your own IP with `Set-NetFirewallRule -DisplayGroup "Remote Desktop" -RemoteAddress 203.0.113.25`. The strongest option is to not expose RDP at all and connect through a VPN or RD Gateway.

| Difficulty | Time | Works on | Needs |
| - | - | - | - |
| Intermediate | 20 to 40 minutes | Windows Server 2019 / 2022 / 2025 | Administrator access, the [VNC console](https://help.freakhosting.com/portals/vps-panel/how-to-enable-and-use-vnc-console-access.md) as a fallback |

## Before you start

* A brute-force attack is a bot trying thousands of passwords against your Remote Desktop port (TCP 3389 by default). Every internet-facing RDP server sees them.
* Check whether you are being targeted: [see failed login attempts](https://help.freakhosting.com/portals/other/how-to-see-failed-login-attempts-on-windows-server.md) (event ID 4625).
* Some steps below can lock you out of RDP. On a VPS, make sure you can sign in with the [VNC console](https://help.freakhosting.com/portals/vps-panel/how-to-enable-and-use-vnc-console-access.md) first. On a dedicated server, [open a ticket](https://freakhosting.com/clientarea/submitticket.php) if you need console (KVM/IPMI) access.

## Which protections should I use?

Use as many layers as you can. Microsoft's own options, from easiest to strongest:

| Protection | Stops | Effort |
| - | - | - |
| Strong, unique passwords | Guessed passwords | Low |
| Account Lockout Policy | Unlimited guessing against one account | Low |
| Network Level Authentication (NLA) | Sessions opening before sign-in | Low |
| Firewall limit by source IP | Everyone except your IPs reaching RDP | Low, if your IP is fixed |
| VPN in front of RDP | RDP being visible on the internet | Medium |
| RD Gateway | Direct RDP; adds HTTPS, policies and MFA options | High |

## 1. Use strong passwords on every account

Every account that can use Remote Desktop needs a long, unique password (16+ characters from a password manager). Bots try `Administrator` and common names first. See [change the Administrator password](https://help.freakhosting.com/portals/other/how-to-change-the-administrator-password-on-windows-server.md). Remove accounts you don't use from **Remote Desktop Users**.

## 2. Set an Account Lockout Policy

An account lockout policy locks an account for a while after too many wrong passwords. Microsoft's baseline recommendation is **10/10/10**: lock after 10 failed attempts, count attempts over 10 minutes, and lock for 10 minutes ([KB5020282](https://support.microsoft.com/en-us/topic/kb5020282-account-lockout-available-for-local-administrators-bce45c4d-f28d-43ad-b6fe-70156cb2dc00)).

**1. Open Local Security Policy**

Press **Win+R**, type `secpol.msc` and press **Enter**.

**2. Go to the lockout settings**

Open **Security Settings > Account Policies > Account Lockout Policy**.

**3. Set the three values**

Set **Account lockout threshold** to `10`, then **Account lockout duration** and **Reset account lockout counter after** to `10` minutes. The lockout duration must be greater than or equal to the reset counter.

**4. Decide on the Administrator account**

The policy **Allow Administrator account lockout** in the same folder controls whether the built-in Administrator can be locked out. Microsoft added it in the October 2022 updates and enables it by default only on computers set up with those updates.

> [!WARNING]
>
> A lockout policy can lock **you** out when bots hammer your username. Keep a second admin account with a different name, and know how to reach the [VNC console](https://help.freakhosting.com/portals/vps-panel/how-to-enable-and-use-vnc-console-access.md). Limiting RDP by IP (step 4) stops the bots from triggering lockouts at all.

## 3. Keep Network Level Authentication on

Network Level Authentication (NLA) makes users authenticate before a Remote Desktop session is created, which reduces the load and risk from unauthenticated connections. To check it, run `SConfig`, choose **7** (**Remote desktop**), then **E** (enable) and **1** (**Network level authentication**, the more secure choice).

## 4. Limit RDP to your own IP addresses

If you connect from a fixed IP address (home, office or another server), tell Windows Firewall to accept RDP only from it. Find your current public IP from a site such as your router's status page or a "what is my IP" search.

**1. Check the current Remote Desktop rules**

```powershell theme={null}
Get-NetFirewallRule -DisplayGroup "Remote Desktop" | Format-Table DisplayName, Enabled, Profile
```

**2. Limit them to your addresses**

```powershell theme={null}
Set-NetFirewallRule -DisplayGroup "Remote Desktop" -RemoteAddress 203.0.113.25,198.51.100.0/24
```

List every address you connect from, separated by commas.

**3. Test before you sign out**

Keep your current session open and start a **new** Remote Desktop connection. If it works, you are done.

If you moved RDP to another port with your own rule, run the same `Set-NetFirewallRule -DisplayName "..." -RemoteAddress ...` on that rule. To undo, set `-RemoteAddress Any`.

> [!WARNING]
>
> If your home IP changes, RDP stops accepting your connections. Sign in with the [VNC console](https://help.freakhosting.com/portals/vps-panel/how-to-enable-and-use-vnc-console-access.md) and add the new address. Don't apply this on a dynamic IP without a console fallback.

**Network-level option:** if your server's IP is protected by our Firewall Panel and its provider supports IP lists, you can also whitelist your addresses in an [IP list](https://help.freakhosting.com/portals/firewall/how-to-create-and-manage-ip-lists.md) and use it in a [DDoS filter](https://help.freakhosting.com/portals/firewall/how-to-apply-ddos-filters.md). Keep the Windows Firewall limit as well.

## 5. Put RDP behind a VPN

With a VPN, RDP is reachable only through an encrypted tunnel, so bots on the internet never see it. Set up [WireGuard on Windows Server](https://help.freakhosting.com/portals/other/how-to-set-up-a-vpn-on-windows-server.md), connect the tunnel, then limit the Remote Desktop rules to the VPN subnet:

```powershell theme={null}
Set-NetFirewallRule -DisplayGroup "Remote Desktop" -RemoteAddress 10.8.0.0/24
```

Test RDP over the tunnel (for example to `10.8.0.1`) before you apply the limit.

## 6. Use RD Gateway for larger setups

**Remote Desktop Gateway** is a Windows Server role that carries RDP inside an encrypted SSL tunnel. It authenticates users first, supports connection and resource authorisation policies (RD CAP and RD RAP), and can use RADIUS for multi-factor authentication. It needs a publicly trusted certificate and more setup, so it suits teams rather than one admin. See Microsoft's [Remote Desktop Services access from anywhere](https://learn.microsoft.com/en-us/windows-server/remote/remote-desktop-services/rds-plan-access-from-anywhere).

## How to check it worked

* **secpol.msc > Account Policies > Account Lockout Policy** shows your three values.
* From an IP that is **not** in your list, `Test-NetConnection 203.0.113.10 -Port 3389` shows `TcpTestSucceeded : False`; from your own IP it shows `True`.
* After a day, the count of [event ID 4625](https://help.freakhosting.com/portals/other/how-to-see-failed-login-attempts-on-windows-server.md) failures should drop sharply.

## Frequently asked questions

### Does changing the RDP port stop brute-force attacks?

It cuts down automated noise, because many bots only try port 3389, but scanners find other ports too. Treat it as an extra, not a replacement for the steps above. See [change the RDP port](https://help.freakhosting.com/portals/other/how-to-change-the-rdp-port-on-windows-server.md).

### Is there a built-in tool like fail2ban for Windows?

The controls Microsoft documents for this are the account lockout policy and firewall rules limited by source IP. Limiting by IP blocks the bots completely, which is stronger than banning addresses one by one after they have already tried.

### What happens if the Administrator account gets locked out?

You must wait for the lockout duration to end, or sign in with another administrator account and unlock it. That is why you should keep a second admin account and console access.

### Can I use multi-factor authentication for RDP?

Microsoft documents MFA for Remote Desktop through RD Gateway, which can use RADIUS-based MFA solutions. A VPN with key-based authentication also adds a second barrier in front of the password.

## Related guides

> [card] [VPS and dedicated server guides](https://help.freakhosting.com/portals/other/vps-and-dedicated-server-guides.md)
>
> Every guide in this section.

> [card] [See failed login attempts](https://help.freakhosting.com/portals/other/how-to-see-failed-login-attempts-on-windows-server.md)
>
> Event ID 4625 explained.

> [card] [Set up a VPN on Windows Server](https://help.freakhosting.com/portals/other/how-to-set-up-a-vpn-on-windows-server.md)
>
> WireGuard in front of RDP.

> [card] [Windows Server security checklist](https://help.freakhosting.com/portals/other/windows-server-security-checklist.md)
>
> Every hardening step.

> [card] [Change the RDP port](https://help.freakhosting.com/portals/other/how-to-change-the-rdp-port-on-windows-server.md)
>
> Move RDP off 3389.

> [card] [Firewall Panel IP lists](https://help.freakhosting.com/portals/firewall/how-to-create-and-manage-ip-lists.md)
>
> Whitelist your addresses at the network edge.

***

> [!NOTE]
>
> **Checked against Microsoft Learn and Microsoft Support: [Account lockout threshold](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/account-lockout-threshold), [KB5020282](https://support.microsoft.com/en-us/topic/kb5020282-account-lockout-available-for-local-administrators-bce45c4d-f28d-43ad-b6fe-70156cb2dc00), [SConfig](https://learn.microsoft.com/en-us/windows-server/administration/server-core/server-core-sconfig), [Configure firewall rules with PowerShell](https://learn.microsoft.com/en-us/windows/security/operating-system-security/network-security/windows-firewall/configure-with-command-line) and [RDS access from anywhere](https://learn.microsoft.com/en-us/windows-server/remote/remote-desktop-services/rds-plan-access-from-anywhere)** on 4 November 2026. Steps were not tested on a live Windows server for this page; menu names can differ slightly between Windows Server 2019, 2022 and 2025.

> [!NOTE]
>
> ### Need Extra Help?
>
> If you encounter any issues, our support team is ready to assist:
>
> * **Live Chat:** Quick assistance via our website.
> * **Support Ticket:** [Open a Ticket](https://freakhosting.com/clientarea/submitticket.php)
> * **Discord:** [Join our Community](https://discord.gg/freakhosting)
> * **Email:** [support@freakhosting.com](mailto:support@freakhosting.com)

> [!TIP]
>
> ### Save on Your Hosting
>
> Ready to upgrade your hosting? Use code **KB20** at checkout for **20% off** your first order!

***

**Last Updated:** November 2026


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.