What is a brute force attack
An attacker tries thousands of usernames and passwords until one works. Servers with Remote Desktop (RDP) open to the internet get these attempts all day.
What is RDPGuard
RDPGuard is a security program for Windows servers. It watches the login attempts to RDP and other services. When an address fails to log in too many times, RDPGuard adds it to a block list automatically. You can also whitelist the IP addresses you trust.
Download and install
- Download RDPGuard from its official website. Choose the version that matches your system (Windows Server or desktop edition).
- Double-click the installer.
- Follow the instructions, choose the install folder and your preferences, and finish.
First start
Open RDPGuard after the installation. It works in the background and watches incoming connection attempts. The default settings already give good protection.
Adjust the settings and whitelist your IPs
Open the settings from the tray icon, or from the RDPGuard window.
Useful settings:
- Failed attempts before a block. For example 5 within 10 minutes.
- Block duration. How long an address stays blocked.
- Whitelist. Add your own office or home IP, so you never lock yourself out.
Review the logs
RDPGuard records successful and failed logins. Look at the log often. Many failures from the same address or country are a sign of an attack.
More ways to protect RDP
- Use a strong password for every account.
- Rename the default
Administratoraccount. - Keep Network Level Authentication on.
- Change the RDP port from 3389, or better, allow RDP only from trusted IPs in the firewall, or only through a VPN.
- Turn on two-factor authentication.
- Keep Windows updated.
Quick recap
- Install RDPGuard, whitelist your own IP and set the number of failed tries.
- Combine it with strong passwords and a firewall.