Problem: locked out of your own server
One wrong firewall rule and Remote Desktop is gone
You tighten the firewall, press apply, and the Remote Desktop window freezes. The server is still running your websites; you just cannot reach it any more. It is the moment every Windows Server owner dreads, and it is why so many servers are left wide open. ServerMaid is built so that this cannot happen: it refuses an address list that leaves you out, and any change that could affect your access reverts itself unless you confirm you are still in.
Part of the Server setup module, £99 £49.50 per server for twelve months. 30-day money-back promise.
How lockouts happen
Almost every lockout is one of a handful of mistakes, and none of them feels like a mistake at the time:
- A block rule for port 3389 is added before the allow rule, or the allow rule is scoped to the wrong profile.
- An allow list is written with the office address but not the address you are actually connected from right now.
- Your home broadband address changes overnight and the allow list still has yesterday's.
- A hardening script from a blog post switches the firewall on for a profile that had no Remote Desktop rule.
- Network Level Authentication or a logon policy is changed and the account you use no longer qualifies.
The common thread is that the change was applied blind, with nothing checking that the person applying it could still get back in. Specialists avoid this with a habit: schedule a revert before you apply, then cancel the revert once you have reconnected. ServerMaid turns that habit into the only way a risky change can run.
What ServerMaid does
A lockout that cannot happen
Your own address is required
ServerMaid knows which address your Remote Desktop session is coming from. It refuses to apply any allow list that leaves that address out, so the classic mistake is caught before the button does anything.
Auto-revert timer
Every change that could affect remote access runs with a timer. Reconnect and confirm you are in, and the change stays. Say nothing, and ServerMaid undoes it by itself and tells you why.
Places, not rules
The Remote Desktop access page lists the places you connect from with a note for each: home, office, a phone hotspot. Add one, press apply, and the firewall rule is written correctly for every profile.
Preview before apply
Every change is listed with its risk label before it runs. Firewall and Remote Desktop changes are marked as affecting access, so you know which ones carry the timer.
Journaled and reversible
Each step is recorded with what it changed, so a deployment can be rolled back step by step from the app, not by remembering what you typed.
Drift watched
If something else on the server changes the rules later, the health score deducts for drift from the baseline and Repair puts the allow list back the way it should be.
Locked out right now? The console rescue
No software on the server can let you back in from outside once the port is closed, ServerMaid included. What always works is the console your hosting provider offers in its control panel: it talks to the server the way a keyboard and screen would, so the firewall is not in the way. Sign in there as an administrator, open a command prompt, and add an allow rule for the address you are connecting from now:
netsh advfirewall firewall add rule name="RDP rescue" dir=in action=allow protocol=TCP localport=3389 remoteip=YOUR.PUBLIC.IP.ADDRESSReplace the last value with your current public address (search "what is my IP" from the machine you are sitting at). Reconnect over Remote Desktop, then tidy up: put the address on your proper allow list and remove the rescue rule. Two things trip people up in provider consoles: pasting often mangles characters, so type the command if it fails, and the keyboard layout may not be the one you expect.
ServerMaid customers who are shut out for any reason can write to support@servermaid.com and a person will walk through the rescue with you.
Questions about lockouts
My home internet address changes. What then?
Add the new address from the Remote Desktop access page while you are still connected from an allowed one, or from another allowed location such as the office or a phone hotspot. If you are ever shut out, support can walk you through the hosting provider's console rescue.
Can I keep a phone hotspot as a spare way in?
Yes, and it is a good habit. Add the hotspot as a place with a note. Mobile networks change addresses often, so treat it as the door you use to add a new home address rather than a permanent entry.
Does ServerMaid touch firewall rules I created?
No. Its rules are named so you can tell them apart, and rules created by you, your provider or other software are never rewritten. The firewall is switched on for every profile so a rule cannot silently apply to the wrong one.
What if I confirm too late and the change has reverted?
Nothing is lost. The change is listed as reverted with the reason, and you apply it again from the same page while connected. The timer is there to protect you, not to race you.
Does this only cover Remote Desktop?
The timer covers any change that could affect remote access, including firewall profile changes and the Windows controls in the security baseline. Ordinary website and database changes do not carry it because they cannot lock you out.
Harden the server without holding your breath
The Server setup module applies a security baseline you can read, with Remote Desktop limited to your places and every risky change protected by the auto-revert timer. Preview the whole plan before anything runs.