Any server with Remote Desktop open to the internet sees automated password-guessing within hours. The good news: a handful of built-in Windows settings stop almost all of it. Work through them in this order.
1. Use long, unique passwords
Every account that can log in over RDP needs a long password (14+ characters) that is not used anywhere else. Rename or disable accounts nobody uses. See Change your Windows server password safely.
2. Keep Network Level Authentication on
Network Level Authentication (NLA) makes the client prove who it is before Windows opens a full login session. It is on by default on current Windows versions; check it:
- Press Windows + R, type
SystemPropertiesRemoteand press Enter. - Under Remote Desktop, make sure Allow connections only from computers running Remote Desktop with Network Level Authentication is ticked.
Or check in PowerShell (1 means on):
(Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp").UserAuthentication3. Set an account lockout policy
A lockout policy pauses an account after too many wrong passwords, which makes guessing very slow. This example locks an account for 15 minutes after 10 failures:
net accounts /lockoutthreshold:10 /lockoutwindow:15 /lockoutduration:15
net accountsWarning: Lockout applies to you too. On recent Windows versions it can also apply to the built-in Administrator account, so a bot guessing passwords can keep your own account locked. That is why step 4 matters. If you are locked out, wait for the lockout duration to pass; do not reinstall the server.
4. Allow RDP only from your IP addresses
This is the single most effective step. Find your public IP address (search "what is my IP" in a browser on your own computer), then limit the built-in Remote Desktop rules to it:
Set-NetFirewallRule -DisplayGroup "Remote Desktop" -RemoteAddress 198.51.100.10
Get-NetFirewallRule -DisplayGroup "Remote Desktop" | Get-NetFirewallAddressFilterList several addresses or ranges separated by commas, for example 198.51.100.10,192.0.2.0/24. To open it to everyone again, use -RemoteAddress Any.
Warning: Many home and mobile connections change IP address from time to time. If yours does, you will be blocked when it changes. You can always get back in through the browser console in the control panel and update the rule, but plan for it: add your office and home addresses, or skip this step if your IP changes daily.
5. Check who is trying to log in
Failed logins are recorded in the Security log as event 4625. This shows the most recent ones:
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625} -MaxEvents 20 | Format-Table TimeCreated, Message -Wrap6. Optional extras
- Move RDP to another port to cut log noise: Change the Remote Desktop port safely.
- Keep Windows patched: Windows Update on a VPS.
- Never share RDP logins; give each person their own: Create Windows users with Remote Desktop access.
Troubleshooting
- Locked out after restricting the IP: open the browser console from the control panel and run the
-RemoteAddresscommand with your new IP. - "The user account is locked": wait for the lockout duration, then sign in with the correct password.