0
Default RDP port scanned by attack tools
Remote Desktop security
RDP Brute Force Protection
An RDP server reachable from the internet is probed by automated password-guessing tools around the clock. Strong passwords and lockout policies slow attackers down; a second factor on the phone stops them, because a correct password is no longer enough to open the session.
A guessed password still meets the phone
0
Separate channels an attacker must beat
0 ms
Typical second-factor time for real users
0
Taps for a user on a trusted pair
The threat
Why attackers brute force Remote Desktop
RDP hands whoever logs in a full interactive desktop. That makes a single working password one of the most valuable things an attacker can find.
Password guessing at scale
Scanners find RDP listeners on the internet and try common usernames with long password lists, hour after hour. Weak or default passwords on any account eventually fall.
Credential stuffing with leaked passwords
Passwords stolen from unrelated breaches are replayed against RDP. If a user reused a password, the attacker logs in on the first try and no lockout policy ever fires.
A foothold for ransomware
Once inside a server, an attacker can disable defenses, move to other machines and deploy ransomware. Stopping the login stops everything that would have followed it.
Hardening checklist
How to protect RDP from brute force attacks
No single control is enough. Layer these, and put the second factor on top so that the password stops being the last line of defense.
Don't expose RDP directly
Put Remote Desktop behind a VPN or a Remote Desktop Gateway, and restrict who can reach it with firewall rules or IP allowlists.
Enforce strong passwords and lockout
Long, unique passwords and an account lockout policy slow guessing down. They do nothing against a password that was already leaked.
Limit who can use RDP
Grant Remote Desktop rights only to accounts that need them, and remove access when people change roles or leave.
Enable Network Level Authentication
NLA requires users to authenticate before a full session is created, which reduces the load and exposure of the login screen.
Patch and monitor
Keep Windows updated against vulnerabilities in the RDP service, and alert on bursts of failed logins.
Add multi factor authentication
Require a second factor on a separate channel, so a guessed or stolen password alone can't open a session.
Know what MFA covers. A second factor protects the login. Vulnerabilities in the RDP service itself are fixed by patching, which is why MFA sits on top of the checklist rather than replacing it.
Where Spriv fits
How Spriv stops RDP brute force logins
STEP 01
The password is only half
Spriv's Credential Provider adds a second factor to the Windows login screen. Even a correct password still needs the user's paired phone.
STEP 02
The attacker's location doesn't match
Adaptive authentication checks that the phone and the computer are in the same place. An attacker somewhere else fails that check, so their login is never approved automatically.
STEP 03
The user sees the attempt
An Allow / Deny prompt shows the username, IP address and server name, so an unexpected request is easy to spot and deny.
Quiet logins make attacks loud. Because real users clear in the background, they rarely see a prompt. When one does appear, it stands out instead of being approved out of habit. In the MFA comparison table, Spriv's adaptive MFA covers brute force, key logging, phishing and stolen phones.
Questions
RDP brute force questions
Does changing the RDP port stop brute force attacks?
It reduces noise from the simplest scanners, but attackers scan every port. Treat it as housekeeping, not protection, and rely on network restrictions and a second factor instead.
Isn't an account lockout policy enough?
Lockout slows guessing, but it can also be used to lock legitimate users out, and it never triggers when the attacker already has the right password from a breach. MFA closes that gap.
What can an administrator do during an attack?
Set the targeted user's status to Deny or Locked in the Spriv control panel, and review the attempt details the push notification reported.
Will MFA slow down my own admins?
Not on a trusted workstation-and-phone pair: the second factor clears in the background, often in about 175 milliseconds. Windows login MFA.
Explore
Related pages
Checkit!
Make a guessed password worthless
Two free users and two free servers, no credit card. Install on your RDP server in under five minutes.