Detect brute force and spraying
ServerBouncer reads the Windows logon events (including 4625) and counts per IP, per user and per subnet. Decoy names such as administrator lead to an immediate block.
RDP protection
RDP brute-force protection for Windows Server
An open RDP port is attacked constantly. ServerBouncer detects brute force and password spraying on RDP, blocks attackers in the kernel via WFP – and can close RDP for everyone until an authorized device knocks.
Block before RDP answers
A block is a WFP filter: further packets from the source no longer reach the RDP service. Active RDP sessions and the whitelist are never blocked.
Close RDP entirely
As a protected service, RDP is blocked for everyone. sbc knock opens it with a signed packet for your device only – the only defense that also stops unknown exploits.
What else ServerBouncer does for RDP
- Handshake detection: connections without a logon, typical for RDP scanners, count as weighted failures.
- Crash detection: if the RDP service crashes, a high-priority incident is created and the peers shortly before are blocked.
- Success after failures: a successful RDP logon after many failures becomes an incident – optionally with disconnect session or disable account.
- Hardening: checks NLA, security layer and exposure of RDP; NLA can be enforced with one click.
- RD Gateway: a dedicated profile for failed logons at the Remote Desktop Gateway.
Changing the RDP port is no protection – a full port scan finds it anyway. Access grants are the more effective choice.
More use cases
Try ServerBouncer on your servers
Starts in learning mode – you first see what would be blocked.