Protecting remote desktop from brute-force attacks

Any server with remote desktop open to the internet gets login attempts from bots within minutes of booting. It is not an attack on you: they try millions of IPs. With these measures they get nowhere.

1. A password that cannot be guessed

First and most protective: 16 characters or more, no dictionary words, and not used anywhere else. A password manager will generate it and remember it for you.

2. See who is trying

The IPs with the most failed attempts in the last 24 hours (PowerShell as administrator):

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=(Get-Date).AddDays(-1)} |
  ForEach-Object { (([xml]$_.ToXml()).Event.EventData.Data | Where-Object Name -eq 'IpAddress').'#text' } |
  Group-Object | Sort-Object Count -Descending | Select-Object -First 10 Count, Name

Hundreds or thousands of attempts are normal on an open port 3389. What matters is that none succeed.

3. Lockout after repeated failures

net accounts /lockoutthreshold:10 /lockoutduration:15 /lockoutwindow:15

After 10 failed attempts, the affected account is locked for 15 minutes. Note: on Windows Server 2022 the built-in Administrator account is not locked out by default (so you are never shut out of your own server), so this mainly protects the other users. That is why the password from point 1 matters most.

4. With a fixed IP, let only yours in

The strongest measure: remote desktop only answers your connection.

# Replace 198.51.100.7 with your public IP (any "what is my IP" site shows it)
Get-NetFirewallRule -DisplayGroup "Remote Desktop" | Set-NetFirewallRule -RemoteAddress 198.51.100.7

If you changed the port and created new rules, apply the same to them with Set-NetFirewallRule -DisplayName "Remote desktop TCP 50000" -RemoteAddress 198.51.100.7. And if your home IP changes, you will be locked out: use the VNC console and open it again with -RemoteAddress Any.

5. Change the port

Moving remote desktop to another port removes most automated attempts. See changing the remote desktop port.

What not to do

Do not rename the Administrator account: the panel uses it to reset the password.
Do not disable NLA (Network Level Authentication): it is on by default and stops many attacks before they reach the login screen.
Do not share your user: create one for each person.