RDP Brute-Force Protection Configuration

• RDP Brute-Force Protection Overview
• How to enable and configure RDP brute-force protection
• Exclusions for RDP detection

RdpGuard protects Remote Desktop servers from brute-force attacks by detecting failed login attempts and automatically blocking IP addresses that reach the configured limit. You can adjust the failed-attempt limit and block duration to suit your server.

Use the RDP Settings dialog to enable protection and configure detection exclusions. To receive notifications when an address is blocked, configure a custom action.

Before you begin, check the recommended audit policy settings. RdpGuard uses failed logon events from the Windows Security log to detect login attempts.

1. Open RdpGuard Dashboard and click RDP under Monitored protocols.

   

2. In the RDP Settings dialog, select Enable RDP protection and click Save.

   

   RdpGuard saves your settings and restarts its service to apply them.

To change the failed-attempt limit or block duration, open Tools, Options, General. These are shared blocking settings, not separate limits for RDP.

On Windows Server 2012 and later, RdpGuard also uses the Remote Desktop Services RdpCoreTS log to help identify the source IP when it is missing from a failed logon event. The traffic-monitoring controls below are shown only on Windows Server 2008 and 2008 R2.

Traffic monitoring on Windows Server 2008 and 2008 R2

On these older systems, failed RDP connections over TLS can leave the source IP missing from the Security log. Enable traffic monitoring to detect these attempts from RDP network traffic.

• WinPcap/Npcap: requires a compatible capture driver. Click Configure... to select the network adapter that receives RDP connections. See WinPcap/Npcap installation and compatibility and network adapter configuration.
• Raw Sockets: does not require a capture driver. Click Configure... to select the local addresses to monitor. See Raw Sockets configuration and limitations.
• RDP ports: leave empty to detect the RDP port automatically, or enter multiple ports separated by commas, for example 3389, 3390.

Click Save to apply the settings.

Windows Security log event 4625 can describe failed logons from RDP and other sources. If legitimate activity is being counted as failed attempts, you can exclude specific events based on their fields. Open RDP Settings and click Exclusions.... See how to exclude Security log events (Event ID 4625) for rule syntax and examples.

To keep a trusted IP address from being blocked regardless of event details, add it to the whitelist instead.