Skip to content

Windows Security: Lock Down Open RDP Access

Quick Fix

The fastest, strongest fix: allow RDP only from your IP address. Every bot on the internet is then blocked at the firewall.

Restrict RDP to your IP (2 minutes)

  1. Find your IP - open https://ifconfig.me from where you connect. Example: 203.0.113.45.
  2. Open the VM Console in your Euronodes panel (so you cannot lock yourself out).
  3. Run this in PowerShell as Administrator, with your IP: 
    Set-NetFirewallRule -DisplayGroup "Remote Desktop" -RemoteAddress "203.0.113.45"
  4. Done. Only your IP can reach RDP now. The brute-force stops immediately.

Multiple trusted IPs: 

Set-NetFirewallRule -DisplayGroup "Remote Desktop" -RemoteAddress ("203.0.113.45","198.51.100.10")

Prefer clicking? Use the firewall GUI

  1. Press Win + R, type wf.msc, press Enter
  2. Inbound Rules -> Remote Desktop - User Mode (TCP-In) -> right-click -> Properties -> Scope tab
  3. Under Remote IP address, choose These IP addresses, Add your IP, click OK

Locked out yourself?

The VM Console in your client panel ignores the firewall, so you can always get back in and update the allowed IP. You cannot fully lock yourself out.

Got a changing home IP?

If your IP is dynamic (most home connections), the allow-list breaks when it changes. Use Auto-block attackers or a VPN instead.

Why Your RDP Got Blocked

The cause

Your RDP port (3389) is open to the whole internet. Bots scan every IP, find the open port, and try thousands of passwords until Windows locks the account. Unlocking the account fixes the symptom; restricting the port fixes the cause. The Quick Fix above is what actually stops it.

Other Ways to Secure RDP

Use these instead of (or on top of) the IP restriction, depending on your setup.

Change the RDP Port

Moving off port 3389 hides you from basic scanners. It is noise reduction, not real security - always combine it with an IP restriction or VPN.

Change the listening port

# Set RDP to a high port, for example 49215
Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name PortNumber -Value 49215

# Open the new port (restricted to your IP) BEFORE restarting
New-NetFirewallRule -DisplayName "RDP Custom Port" -Direction Inbound -Protocol TCP -LocalPort 49215 -Action Allow -RemoteAddress "203.0.113.45"

Restart-Service TermService -Force
Connect afterwards with server-ip:49215.

Open the new port before restarting

If you restart the service before the firewall allows the new port and your IP, you lose RDP. The VM Console is your safety net.

Auto-Block Attackers

Best when you have a dynamic IP or many users and cannot use a fixed allow-list. These tools watch the security log and ban any IP that fails to log in too many times.

Common tools

  • RDPGuard - paid, purpose-built for Windows RDP
  • Cyberarms IDDS - free, monitors RDP and other services
  • PowerShell + firewall script - free, parses Event ID 4625 and adds block rules

Attackers get one or two tries, then a firewall ban. The brute-force never reaches the lockout threshold.

VPN or Private Access (Most Secure)

Best practice for production: never expose RDP to the public internet.

Approaches

  • VPN - connect to a VPN first, RDP firewalled to the VPN subnet only
  • Zero-trust - Cloudflare Tunnel or Tailscale expose RDP only to authenticated devices, no open public port
  • Jump host - RDP allowed only from one hardened management server

Tune the Lockout Policy

A lockout policy slows attackers but also locks out legitimate users, and lets attackers lock you out on purpose. Treat it as a backstop, not your main defense.

Configure Account Lockout Policy

  1. Press Win + R, type gpedit.msc, press Enter
  2. Go to Computer Configuration > Windows Settings > Security Settings > Account Policies > Account Lockout Policy
  3. Reasonable values: threshold 10, duration 15 min, reset counter 15 min

Verify You Are Protected

Quick checks

# Which IPs can reach RDP
Get-NetFirewallRule -DisplayGroup "Remote Desktop" | Get-NetFirewallAddressFilter | Select-Object RemoteAddress

# Failed logins in the last 24h (should drop to near zero after locking down)
(Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4625; StartTime=(Get-Date).AddHours(-24)}).Count

Test from outside

From a network not on your allow-list, try to connect. It should time out. If it still shows a login screen, the restriction did not apply and the port is still public.

FAQ

Why does my account keep getting locked even after I unlock it?

The brute-force is still running against the open port. Apply the Quick Fix (restrict to your IP) or auto-block attackers, and the lockouts stop.

Is changing the RDP port enough on its own?

No. It only hides you from basic scanners. Always combine it with an IP restriction or VPN.

I have a dynamic home IP, what should I do?

Use auto-blocking or a VPN / zero-trust tool. You can always update firewall rules from the VM Console.

Should I just disable RDP and use the console only?

For servers you rarely manage, yes - that is the safest option. Enable RDP only when needed.

Contact Support

Need help?

  • Locked out now: Use the VM Console, then apply the Quick Fix above.
  • Not sure which option fits: Open a ticket describing how you connect (static IP, dynamic IP, multiple users).
  • Ongoing attacks: Include Event Viewer logs (Event ID 4625) and source IPs.

Related: Unlock User Account | Reset Windows Password | Bulk Firewall Rules