{"id":17604,"date":"2025-09-05T13:05:56","date_gmt":"2025-09-05T10:05:56","guid":{"rendered":"https:\/\/unihost.com\/help\/?p=17604"},"modified":"2025-09-05T13:05:56","modified_gmt":"2025-09-05T10:05:56","slug":"protect-your-windows-rdp-from-brute-force","status":"publish","type":"post","link":"https:\/\/unihost.com\/help\/protect-your-windows-rdp-from-brute-force\/","title":{"rendered":"Protect your Windows RDP from brute force"},"content":{"rendered":"

Remote Desktop Protocol (RDP) is a convenient way to access Windows servers remotely. However, it’s also a common entry point for brute-force attacks, where bots try thousands of login combinations to gain unauthorized access.
<\/span>To protect your Windows RDP from brute-force attacks, we offer a lightweight and effective solution \u2014 the rdpf2b.ps1<\/em> PowerShell script. It works similarly to fail2ban<\/strong><\/em>, monitoring failed login attempts and blocking suspicious IP addresses using the Windows Firewall.<\/span><\/p>\n

Why You Need RDP Brute-Force Protection<\/strong><\/span><\/h3>\n

Malicious bots scan the internet for open RDP ports and repeatedly attempt to guess passwords. If left unprotected, your server is vulnerable to unauthorized access, data breaches, or worse \u2014 ransomware.<\/span><\/p>\n

Our script provides a simple, self-hosted RDP brute-force protection mechanism that does not require external software or services.<\/span><\/p>\n

You can also read Microsoft\u2019s official guidance on securing RDP<\/a> to understand the risk level.<\/span><\/p>\n

Script Features<\/span><\/h3>\n
    \n
  • Blocks\u00a0login attempts to non-existent accounts<\/span><\/li>\n
  • Analyzes Windows Security Event Logs (ID 4625)<\/span><\/li>\n
  • Blocks IPs using Windows Firewall<\/span><\/li>\n
  • Sets up automatic scheduled tasks<\/span><\/li>\n
  • Cleans up old logs<\/span><\/li>\n<\/ul>\n

    Installation Guide<\/span><\/h3>\n

    Run all commands in PowerShell as Administrator<\/strong><\/span><\/p>\n

    1. Download the script<\/span><\/p>\n

    wget https:\/\/screen.unihost.com\/rdpf2b.ps1 -OutFile C:\\rdpf2b.ps1<\/span><\/pre>\n
    2. Allow running local scripts<\/span><\/p>\n
    \n
    Set-ExecutionPolicy RemoteSigned<\/span><\/pre>\n<\/div>\n
    3. Install the script<\/span><\/p>\n
    C:\\rdpf2b.ps1 -install<\/span><\/pre>\n
    4. Set up scheduled tasks<\/span><\/p>\n
    C:\\rdp_guard\\rdpf2b.ps1 -task<\/span><\/pre>\n
    \n
    This will:<\/span><\/strong><\/span><\/p>\n<\/div>\n
      \n
    • Automatically check for brute-force attempts every 10 minutes<\/span><\/li>\n
    • Clean up old log files<\/span><\/li>\n
    • Periodically clear the Windows Security log<\/span><\/li>\n<\/ul>\n
      Unblock an IP manually<\/strong><\/span><\/p>\n
      To remove an IP address from the block list:<\/span><\/p>\n
      C:\\rdp_guard\\rdpf2b.ps1 -delip 192.168.1.100<\/span><\/pre>\n
      Replace 192.168.1.100<\/em> with the IP you want to unblock.<\/span><\/p>\n
      \"Protect<\/span><\/p>\n
      Conclusion<\/strong><\/span><\/h3>\n
      The rdpf2b.ps1<\/em> script is a powerful and easy way to protect your Windows RDP from brute-force attacks. It runs in the background, uses only built-in tools, and requires minimal configuration.<\/span><\/p>\n\n\n
      <\/p>\n\n\n\n
      <\/p>\n","protected":false},"excerpt":{"rendered":"
      Remote Desktop Protocol (RDP) is a convenient way to access Windows servers remotely. However, it’s also a common entry point for brute-force attacks, where bots try thousands of login combinations to gain unauthorized access.To protect your Windows RDP from brute-force attacks, we offer a lightweight and effective solution \u2014 the rdpf2b.ps1 PowerShell script. It works […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[158],"tags":[499,726,712],"class_list":["post-17604","post","type-post","status-publish","format-standard","hentry","category-dedicated-servers","tag-fail2ban","tag-rdp-2","tag-windows-2"],"yoast_head":"\nProtect your Windows RDP from brute force - Unihost.FAQ<\/title>\n<meta name=\"description\" content=\"Lightweight PowerShell script to protect Windows RDP from brute-force attacks using the Event Log and Windows Firewall.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/unihost.com\/help\/protect-your-windows-rdp-from-brute-force\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Protect your Windows RDP from brute force - Unihost.FAQ\" \/>\n<meta property=\"og:description\" content=\"Lightweight PowerShell script to protect Windows RDP from brute-force attacks using the Event Log and Windows Firewall.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/unihost.com\/help\/protect-your-windows-rdp-from-brute-force\/\" \/>\n<meta property=\"og:site_name\" content=\"Unihost.FAQ\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/unihost\/\" \/>\n<meta property=\"article:published_time\" content=\"2025-09-05T10:05:56+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/unihost.com\/help\/minio.php?2025\/08\/Screenshot_NL_20250826_111331.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1393\" \/>\n\t<meta property=\"og:image:height\" content=\"592\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Unihost Support\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@unihost\" \/>\n<meta name=\"twitter:site\" content=\"@unihost\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Unihost Support\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/unihost.com\/help\/protect-your-windows-rdp-from-brute-force\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/unihost.com\/help\/protect-your-windows-rdp-from-brute-force\/\"},\"author\":{\"name\":\"Unihost Support\",\"@id\":\"https:\/\/unihost.com\/help\/#\/schema\/person\/bb5ae95f38577c920e6a7507888b715a\"},\"headline\":\"Protect your Windows RDP from brute force\",\"datePublished\":\"2025-09-05T10:05:56+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/unihost.com\/help\/protect-your-windows-rdp-from-brute-force\/\"},\"wordCount\":277,\"publisher\":{\"@id\":\"https:\/\/unihost.com\/help\/#organization\"},\"image\":{\"@id\":\"https:\/\/unihost.com\/help\/protect-your-windows-rdp-from-brute-force\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/unihost.com\/help\/minio.php?2025\/08\/Screenshot_NL_20250826_111331.jpg\",\"keywords\":[\"fail2ban\",\"RDP\",\"Windows\"],\"articleSection\":[\"02. Dedicated servers\"],\"inLanguage\":\"en\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/unihost.com\/help\/protect-your-windows-rdp-from-brute-force\/\",\"url\":\"https:\/\/unihost.com\/help\/protect-your-windows-rdp-from-brute-force\/\",\"name\":\"Protect your Windows RDP from brute force - Unihost.FAQ\",\"isPartOf\":{\"@id\":\"https:\/\/unihost.com\/help\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/unihost.com\/help\/protect-your-windows-rdp-from-brute-force\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/unihost.com\/help\/protect-your-windows-rdp-from-brute-force\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/unihost.com\/help\/minio.php?2025\/08\/Screenshot_NL_20250826_111331.jpg\",\"datePublished\":\"2025-09-05T10:05:56+00:00\",\"description\":\"Lightweight PowerShell script to protect Windows RDP from brute-force attacks using the Event Log and Windows Firewall.\",\"breadcrumb\":{\"@id\":\"https:\/\/unihost.com\/help\/protect-your-windows-rdp-from-brute-force\/#breadcrumb\"},\"inLanguage\":\"en\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/unihost.com\/help\/protect-your-windows-rdp-from-brute-force\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en\",\"@id\":\"https:\/\/unihost.com\/help\/protect-your-windows-rdp-from-brute-force\/#primaryimage\",\"url\":\"https:\/\/unihost.com\/help\/minio.php?2025\/08\/Screenshot_NL_20250826_111331.jpg\",\"contentUrl\":\"https:\/\/unihost.com\/help\/minio.php?2025\/08\/Screenshot_NL_20250826_111331.jpg\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/unihost.com\/help\/protect-your-windows-rdp-from-brute-force\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Unihost\",\"item\":\"https:\/\/unihost.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Help\",\"item\":\"https:\/\/unihost.com\/help\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Protect your Windows RDP from brute force\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/unihost.com\/help\/#website\",\"url\":\"https:\/\/unihost.com\/help\/\",\"name\":\"Unihost.FAQ\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\/\/unihost.com\/help\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/unihost.com\/help\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/unihost.com\/help\/#organization\",\"name\":\"Unihost\",\"alternateName\":\"Unihost\",\"url\":\"https:\/\/unihost.com\/help\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en\",\"@id\":\"https:\/\/unihost.com\/help\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/unihost.com\/help\/minio.php?2026\/01\/minio.png\",\"contentUrl\":\"https:\/\/unihost.com\/help\/minio.php?2026\/01\/minio.png\",\"width\":300,\"height\":300,\"caption\":\"Unihost\"},\"image\":{\"@id\":\"https:\/\/unihost.com\/help\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/unihost\/\",\"https:\/\/x.com\/unihost\",\"https:\/\/www.instagram.com\/unihost\/?hl=en\",\"https:\/\/www.linkedin.com\/company\/unihost-com\",\"https:\/\/www.youtube.com\/channel\/UCITKsxMDnslQY8brN3advgw\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/unihost.com\/help\/#\/schema\/person\/bb5ae95f38577c920e6a7507888b715a\",\"name\":\"Unihost Support\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en\",\"@id\":\"https:\/\/unihost.com\/help\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/a0c9db17c2a0d93e8a0d5ac123f8c5db750ad4d3d5657369c0c4e480f5af77b8?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/a0c9db17c2a0d93e8a0d5ac123f8c5db750ad4d3d5657369c0c4e480f5af77b8?s=96&d=mm&r=g\",\"caption\":\"Unihost Support\"},\"sameAs\":[\"https:\/\/unihost.com\/\"],\"url\":\"https:\/\/unihost.com\/help\/author\/support\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Protect your Windows RDP from brute force - Unihost.FAQ","description":"Lightweight PowerShell script to protect Windows RDP from brute-force attacks using the Event Log and Windows Firewall.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/unihost.com\/help\/protect-your-windows-rdp-from-brute-force\/","og_locale":"en_US","og_type":"article","og_title":"Protect your Windows RDP from brute force - Unihost.FAQ","og_description":"Lightweight PowerShell script to protect Windows RDP from brute-force attacks using the Event Log and Windows Firewall.","og_url":"https:\/\/unihost.com\/help\/protect-your-windows-rdp-from-brute-force\/","og_site_name":"Unihost.FAQ","article_publisher":"https:\/\/www.facebook.com\/unihost\/","article_published_time":"2025-09-05T10:05:56+00:00","og_image":[{"width":1393,"height":592,"url":"https:\/\/unihost.com\/help\/minio.php?2025\/08\/Screenshot_NL_20250826_111331.jpg","type":"image\/jpeg"}],"author":"Unihost Support","twitter_card":"summary_large_image","twitter_creator":"@unihost","twitter_site":"@unihost","twitter_misc":{"Written by":"Unihost Support","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/unihost.com\/help\/protect-your-windows-rdp-from-brute-force\/#article","isPartOf":{"@id":"https:\/\/unihost.com\/help\/protect-your-windows-rdp-from-brute-force\/"},"author":{"name":"Unihost Support","@id":"https:\/\/unihost.com\/help\/#\/schema\/person\/bb5ae95f38577c920e6a7507888b715a"},"headline":"Protect your Windows RDP from brute force","datePublished":"2025-09-05T10:05:56+00:00","mainEntityOfPage":{"@id":"https:\/\/unihost.com\/help\/protect-your-windows-rdp-from-brute-force\/"},"wordCount":277,"publisher":{"@id":"https:\/\/unihost.com\/help\/#organization"},"image":{"@id":"https:\/\/unihost.com\/help\/protect-your-windows-rdp-from-brute-force\/#primaryimage"},"thumbnailUrl":"https:\/\/unihost.com\/help\/minio.php?2025\/08\/Screenshot_NL_20250826_111331.jpg","keywords":["fail2ban","RDP","Windows"],"articleSection":["02. Dedicated servers"],"inLanguage":"en"},{"@type":"WebPage","@id":"https:\/\/unihost.com\/help\/protect-your-windows-rdp-from-brute-force\/","url":"https:\/\/unihost.com\/help\/protect-your-windows-rdp-from-brute-force\/","name":"Protect your Windows RDP from brute force - Unihost.FAQ","isPartOf":{"@id":"https:\/\/unihost.com\/help\/#website"},"primaryImageOfPage":{"@id":"https:\/\/unihost.com\/help\/protect-your-windows-rdp-from-brute-force\/#primaryimage"},"image":{"@id":"https:\/\/unihost.com\/help\/protect-your-windows-rdp-from-brute-force\/#primaryimage"},"thumbnailUrl":"https:\/\/unihost.com\/help\/minio.php?2025\/08\/Screenshot_NL_20250826_111331.jpg","datePublished":"2025-09-05T10:05:56+00:00","description":"Lightweight PowerShell script to protect Windows RDP from brute-force attacks using the Event Log and Windows Firewall.","breadcrumb":{"@id":"https:\/\/unihost.com\/help\/protect-your-windows-rdp-from-brute-force\/#breadcrumb"},"inLanguage":"en","potentialAction":[{"@type":"ReadAction","target":["https:\/\/unihost.com\/help\/protect-your-windows-rdp-from-brute-force\/"]}]},{"@type":"ImageObject","inLanguage":"en","@id":"https:\/\/unihost.com\/help\/protect-your-windows-rdp-from-brute-force\/#primaryimage","url":"https:\/\/unihost.com\/help\/minio.php?2025\/08\/Screenshot_NL_20250826_111331.jpg","contentUrl":"https:\/\/unihost.com\/help\/minio.php?2025\/08\/Screenshot_NL_20250826_111331.jpg"},{"@type":"BreadcrumbList","@id":"https:\/\/unihost.com\/help\/protect-your-windows-rdp-from-brute-force\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Unihost","item":"https:\/\/unihost.com\/"},{"@type":"ListItem","position":2,"name":"Help","item":"https:\/\/unihost.com\/help\/"},{"@type":"ListItem","position":3,"name":"Protect your Windows RDP from brute force"}]},{"@type":"WebSite","@id":"https:\/\/unihost.com\/help\/#website","url":"https:\/\/unihost.com\/help\/","name":"Unihost.FAQ","description":"","publisher":{"@id":"https:\/\/unihost.com\/help\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/unihost.com\/help\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en"},{"@type":"Organization","@id":"https:\/\/unihost.com\/help\/#organization","name":"Unihost","alternateName":"Unihost","url":"https:\/\/unihost.com\/help\/","logo":{"@type":"ImageObject","inLanguage":"en","@id":"https:\/\/unihost.com\/help\/#\/schema\/logo\/image\/","url":"https:\/\/unihost.com\/help\/minio.php?2026\/01\/minio.png","contentUrl":"https:\/\/unihost.com\/help\/minio.php?2026\/01\/minio.png","width":300,"height":300,"caption":"Unihost"},"image":{"@id":"https:\/\/unihost.com\/help\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/unihost\/","https:\/\/x.com\/unihost","https:\/\/www.instagram.com\/unihost\/?hl=en","https:\/\/www.linkedin.com\/company\/unihost-com","https:\/\/www.youtube.com\/channel\/UCITKsxMDnslQY8brN3advgw"]},{"@type":"Person","@id":"https:\/\/unihost.com\/help\/#\/schema\/person\/bb5ae95f38577c920e6a7507888b715a","name":"Unihost Support","image":{"@type":"ImageObject","inLanguage":"en","@id":"https:\/\/unihost.com\/help\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/a0c9db17c2a0d93e8a0d5ac123f8c5db750ad4d3d5657369c0c4e480f5af77b8?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/a0c9db17c2a0d93e8a0d5ac123f8c5db750ad4d3d5657369c0c4e480f5af77b8?s=96&d=mm&r=g","caption":"Unihost Support"},"sameAs":["https:\/\/unihost.com\/"],"url":"https:\/\/unihost.com\/help\/author\/support\/"}]}},"_links":{"self":[{"href":"https:\/\/unihost.com\/help\/wp-json\/wp\/v2\/posts\/17604","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/unihost.com\/help\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/unihost.com\/help\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/unihost.com\/help\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/unihost.com\/help\/wp-json\/wp\/v2\/comments?post=17604"}],"version-history":[{"count":22,"href":"https:\/\/unihost.com\/help\/wp-json\/wp\/v2\/posts\/17604\/revisions"}],"predecessor-version":[{"id":17671,"href":"https:\/\/unihost.com\/help\/wp-json\/wp\/v2\/posts\/17604\/revisions\/17671"}],"wp:attachment":[{"href":"https:\/\/unihost.com\/help\/wp-json\/wp\/v2\/media?parent=17604"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/unihost.com\/help\/wp-json\/wp\/v2\/categories?post=17604"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/unihost.com\/help\/wp-json\/wp\/v2\/tags?post=17604"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}