RdpGuard FAQ

Yes, we provide a trial version. RdpGuard includes a fully functional 30-day free trial. Feel free to install it on your server to see how it works for your use case.

Please use the following link to make your purchase:
https://rdpguard.com/purchase.aspx

Select the required number of licenses and click Continue.

On the checkout page, choose your preferred payment method and follow the instructions to complete your order.

Yes, you can pay by purchase order.

Please use the following link to place your order:
https://sites.fastspring.com/netsdk/product/e11147e08ef2

Select Purchase Order as the payment method and follow the on-screen instructions to generate the invoice.

The license will be sent automatically once the payment is received in full.

The RdpGuard license is a one-time purchase and is lifetime. Each license includes one year of maintenance, which covers free upgrades, support, and access to IP Cloud and Geo-IP services.

After the first year, you may continue using your current version indefinitely. Protection based on locally detected failed login attempts continues to work, but you will no longer receive updates from IP Cloud and Geo-IP services.

If you wish to continue receiving updates and support beyond the first year, you can purchase an additional year of maintenance for $49.95.

The price for one RdpGuard license is as follows:

Please use the following link to make your purchase:
https://sites.fastspring.com/netsdk/product/e11147e08ef2

If you need a formal invoice, please select Purchase Order as the payment method and follow the on-screen instructions to generate the invoice.

We are sorry for the inconvenience. Please try our alternative payment processor FastSpring

Please allow 2-3 business days for wire transfer payments to be processed.

If you made the wire transfer more than 3 days ago, please resubmit your request via: https://fastspring.com/consumer-support-form/

Attach your wire transfer confirmation or transfer advice so the e-commerce team can locate the payment and process your order.

We apologize for any inconvenience.

Please follow the steps below to activate your license key:

• Start RdpGuard Dashboard
• Click Help, then Product Activation
• Enter your license key into the corresponding text box
• Click Activate

Please follow the steps below to perform offline activation:

• Click Help, then Product Activation
• Double-click on the key icon
• The Offline Activation window will open
• Follow the on-screen instructions to generate an activation request

Please follow the steps below to transfer your license to another PC:

• Click Help, then Product Activation on the first PC.
• Click Deactivate Pro license on this computer.
• Activate your license on the new PC.

If you need us to recover the key associated with the old machine, please open Help, then Product Activation on the old PC and provide us with the Hardware ID.

RdpGuard is licensed per machine. You need to obtain a license for each PC.

We offer volume discounts for multi-license orders. You can find more details on the following page: https://rdpguard.com/purchase.aspx.

Please make sure that the RdpGuard service (rdpguard-svc.exe) is allowed to contact the activation server at rdpguard.com on port 443.

This is required to activate the trial.

To allow Internet access for the RdpGuard service:

• Open Windows Firewall and allow Internet access for C:\Program Files\RdpGuard\rdpguard-svc.exe (the default installation path).
• If you are using a third-party firewall, ensure that the RdpGuard service is allowed Internet access as well.

A maintenance purchase provides a new license key with 365 days of maintenance from its first activation. It does not extend the maintenance period of your existing key.

You can purchase maintenance in advance and activate the new key when your current maintenance expires. The new period starts when you activate that key, not when you purchase it.

Feel free to purchase the required number of RdpGuard licenses for reselling or on behalf of your customer.

You may specify your contact details during the purchase, as the license is not bound to the purchaser.

The license is delivered immediately to the e-mail you specify during the purchase.

We sell our products through FastSpring, the official reseller of RdpGuard software worldwide.

FastSpring operates in all countries, supports multiple local payment methods, and provides all necessary documents and invoices for your purchase.

You may use the following link to place your order:
https://sites.fastspring.com/netsdk/product/e11147e08ef2

Please use the following link to request a tax-exempt order link:
https://fastspring.com/consumer-support-form/tax-vat-gst/

Please use the following form to request a tax refund:
https://fastspring.com/consumer-support-form/tax-vat-gst/

We provide standard email support. The usual response time is within 24 hours from Monday to Friday.

Windows Server has various security restrictions that may prevent downloaded files from executing. One such feature can lock files, making them unresponsive when opened.

If you downloaded the RdpGuard installer but it doesn't start when double-clicked, it is likely blocked by the system. To resolve this, follow these steps:

1. Right-click the installer file.
2. Select Properties.
3. Go to the General tab.
4. At the bottom, look for a security warning that says the file is blocked.
5. Check the Unblock checkbox and click Apply.

Once the file is unblocked, you should be able to install RdpGuard without issues.

You may try the following steps:

1. Open Control Panel, Administrative Tools, Services.
2. Find RdpGuardService, right-click it, and select Properties.
3. Set the Startup type to Automatic (Delayed Start).

This should help if the RdpGuard service does not start during system startup.

You can automate the RdpGuard service check and restart using a batch file executed by Windows Task Scheduler every 5 minutes or so. Configure the task to Run with highest privileges so it can start the service. Use the following script:

@echo off

Rem Schedule this file to run every 5 minutes or so

Rem Look for the RdpGuard service in the list of started services
net start | find /i "RdpGuard"

Rem if not found, start it
if "%errorlevel%"=="1" (
   net start "RdpGuardService"
)

You can also download a preconfigured script from here:
https://rdpguard.com/tools/check-rdpguard-service.zip .

Please ensure that the Test Mode option is turned off. In RdpGuard versions prior to 9.9.7, this option was named "Dry run".

This feature is designed for safe configuration testing, ensuring that any potential access control errors can be rectified by simply restarting the server, thereby restoring remote access for recovery purposes.

To disable it, open the Geo-IP settings and uncheck the Test mode option: https://rdpguard.com/geoip-blocking.aspx#dry-run

Additionally, consider switching to the Max database version in Geo-IP settings for more accurate results: https://rdpguard.com/geoip-blocking.aspx#advanced-settings

These local IP addresses are recorded in your system event logs.

If you check the Security event log, you may find corresponding 4625 events with these addresses. Please review the event details for troubleshooting.

This event is generated for failed login attempts, including:

• Failed RDP connections
• Unsuccessful access to network shares or printers
• Failed authentication attempts by local processes, such as:
  • Processes requiring user elevation
  • Scheduled tasks running under specific accounts
  • Services attempting to start with incorrect credentials

The exact reason depends on your system configuration. In most cases, these messages can be safely ignored unless they indicate an actual security concern.

If you want to exclude certain 4625 events from processing and can define a pattern based on the event details, you may use exclusion rules: https://rdpguard.com/rdp-exclusions-for-security-log-event-id-4625.aspx .

The limit applies to failed attempts that RdpGuard has detected. Some server software buffers log entries before writing them, and RdpGuard checks file-based logs periodically. For Windows Event Log monitoring, RdpGuard receives notifications of new events.

If an attacker is generating failed login attempts at a high rate, they may be able to exceed the configured limit while log entries are being recorded and processed and the block is being applied. The configured limit is a detection threshold, not a guarantee of exactly that many attempts reaching the server.

This is a known issue with the Mac RDP client. It appears to perform a "test" connection attempt before the user enters the password, which results in a failed login attempt on the server.

Unfortunately, there is no way to distinguish these attempts from actual brute-force attacks, so there is currently no workaround.

You may consider the following options:

• Whitelist the client's address in Tools, Whitelist.
• Increase the number of allowed failed login attempts in Tools, Options, General.

The most common reason for seeing a local network (gateway) address in 4625 events is that the router, firewall, or gateway is masking the real IP addresses of incoming connections. Unfortunately, this behavior is controlled by the network device, and there is nothing RdpGuard can change on its side.

You may be able to adjust this behavior in your router/firewall/gateway settings. We recommend checking the NAT configuration and consulting the device manufacturer or network administrator for more details.

Based on customer feedback, this issue can often be resolved by configuring proper NAT settings on the router/firewall/gateway to preserve the original source IP.

There are a few possible reasons why no IP addresses are being blocked:

1. Audit settings are not configured to log failed login attempts.
   Please check the following tutorial to learn how to enable it:
   https://rdpguard.com/audit-policy-settings.aspx .
2. Your system is not under attack.
   Check the Security event log and the CoreTS log in Event Viewer:
   Event Viewer, Applications and Services Logs, Microsoft, Windows, RemoteDesktopServices-RdpCoreTS, Operational.
   If there are no corresponding events, there may be no failed attempts to detect. However, missing events alone do not prove this; first verify that auditing is enabled and that you are checking the relevant logs.
3. Proactive protection by IP Cloud.
   With an active RdpGuard license, all suspicious addresses may have already been blocked by the IP Cloud before they even had a chance to attempt a login.

This error indicates that RDP access via a web browser (RD Web Access) is not configured on your server.

RD Web Access is different from standard RDP and is usually disabled on servers by default.

If you are not accessing your server desktop via a web browser, you do not need to enable the RD-Web Access detection engine.

RD Web Access protection uses IIS logs to identify the source IP address. IIS buffers log entries, so failed login attempts may not appear in the log immediately.

RdpGuard checks for new entries periodically and blocks an IP when the detected attempts reach your configured limit. During a rapid attack, additional attempts can occur before the entries are written, processed and the block is applied.

The number of additional attempts depends on the attack rate and logging delay; there is no fixed upper limit. See the RD Web Access protection settings to check your configuration.

Yes. To permanently block a specific IP address or range, open Tools, Blacklist, add the entry and save your changes. It remains blocked until you remove it from the blacklist.

Automatic blocks triggered by failed login attempts are temporary. Their maximum duration is 8,760 hours (365 days), configured in Tools, Options, General.

See how to manage the whitelist and blacklist.

Yes, you can manually unblock a single IP address. Follow the instructions here:
https://rdpguard.com/how-to-unban-ip-address.aspx .

RdpGuard runs as a service, and protection continues even if no user is logged in.

The RdpGuard service is automatically installed during setup and starts automatically when the system boots.

You can close the RdpGuard Dashboard and log out; the RdpGuard service will continue running in the background.

No, Windows Firewall is not required. RdpGuard works directly with the Windows Filtering Platform to block IP addresses.

RdpGuard works with custom RDP ports without additional configuration. It automatically detects the correct port.

These entries are added automatically when you right-click on a blocked IP address and select Unblock and Whitelist.

If you added them by mistake or no longer need them whitelisted, you can safely remove these entries from the whitelist.

Yes, this can be achieved using Geo-IP in allow mode. For more details, visit: https://rdpguard.com/geoip-blocking.aspx#geoip-in-allow-mode .

You can also use a custom allow list to specify permitted IPs: https://rdpguard.com/geoip-blocking.aspx#custom-allow-list .

Yes, you can export the blocked IP addresses using the RdpGuard CLI.

Here's how you can do it:

1. Open the Run dialog by pressing Win + R.
2. Paste the following command and press Enter:

For a text file:

cmd /c "%ProgramFiles(x86)%\RdpGuard\rdpguard-cli.exe" /ip show > %USERPROFILE%\Desktop\blocked-addresses.txt
        

This will create the blocked-addresses.txt file on your Desktop.

For a CSV file:

cmd /c "%ProgramFiles(x86)%\RdpGuard\rdpguard-cli.exe" /ip export csv %USERPROFILE%\Desktop\blocked-addresses.csv
        

This will create the blocked-addresses.csv file on your Desktop.

For more details, refer to the CLI documentation here: https://rdpguard.com/command-line-interface.aspx#ip-object .

You can find the log files in the following location:

%ProgramData%\RdpGuard\Logs
        

Note:%ProgramData% is a hidden folder. You can access it by pasting the path into the Windows Explorer address bar or the Win + R dialog.

Yes, OWA and ActiveSync protocols are covered by RDP protection.

Both OWA and ActiveSync generate the same 4625 events as RDP, so enabling RDP protection in RdpGuard will also monitor and block failed login attempts for these protocols.

RdpGuard includes a fully functional 30-day free trial. Feel free to install it on your server to test how it works for your use case.

Unfortunately, RD Gateway and Connection Broker setups are not supported at this time. However, we appreciate your suggestion and will consider this feature for future versions.

RdpGuard is designed for single servers that are directly exposed to the Internet. When installed on an RD Gateway, RdpGuard will only protect the server itself and not the hosts whose connections pass through it.

You may still use RdpGuard on the Gateway to leverage the IP Cloud feature:
https://rdpguard.com/ipcloud.aspx .

With IP Cloud, you can block many active IP addresses currently used for brute-force attacks worldwide.

Yes, you can transfer RdpGuard settings by copying the configuration files from:

%ProgramData%\RdpGuard
        

Note: The %ProgramData% folder is hidden. You can access it by pasting the path into the Windows Explorer address bar or the Win + R dialog.

Before copying the files to the new machine, stop the RdpGuard service.

After copying the files, restart the RdpGuard service on the new machine.

Failed logon attempts over SSL/TLS do not log the attacker's IP address in Windows Server 2008 and Windows Server 2008 R2.

In such cases, RdpGuard uses an alternative, socket-based approach to detect the attacker's IP address.

To enable failed logon detection over SSL/TLS on Windows Server 2008, follow these steps:

• Install WinPcap/Npcap
• Restart the RdpGuard service via Tools, RdpGuard Service, Restart.
• Open Rdp Protection Settings and change the monitoring method to WinPcap.