Problem: RDP brute-force attacks
Thousands of failed logons a day on your Windows Server?
Put a Windows Server on the internet with Remote Desktop open and the password guessing starts within minutes. The security log fills with failed logons from addresses you have never heard of, the CPU ticks over rejecting them, and one weak or reused password is all it takes. ServerMaid closes Remote Desktop to everyone except the places you connect from, and does it without locking you out.
Part of the Server setup module, £99 £49.50 per server for twelve months. 30-day money-back promise.
Why every public Windows Server gets hammered
Most hosting providers hand over a Windows Server with Remote Desktop listening on port 3389 to any address in the world, because that is how you log in for the first time. Bots scan the entire internet for that port continuously. Once they find it they try username and password lists around the clock, from thousands of addresses, for as long as the server exists.
The damage is not only the risk of a guessed password. The noise buries real events in the security log, the attempts consume CPU and memory that your websites should have, and an account lockout policy meant to protect you can be turned against you by an attacker who locks out the administrator account on purpose.
Changing the port hides the door for a few days at most. Blockers that ban addresses after a few failures play whack-a-mole with an endless supply of new ones. The fix that actually works is the one a specialist would apply on day one: only the addresses you connect from may reach Remote Desktop at all.
What ServerMaid does
Close the door, keep your key
Remote Desktop only from your places
The firewall allows Remote Desktop only from the addresses you list: home, office, a phone hotspot, each with a note so you know which is which. Every other address is dropped before it ever reaches the logon screen.
Network Level Authentication required
A connection must authenticate before a session is even created, so an attacker who does reach the port cannot poke at the logon screen or exhaust the server with half-open sessions.
Lockout and password policy set
Account lockout thresholds, password policy and logon auditing are applied from ServerMaid's versioned security baseline, through the documented Windows mechanisms, each one explained before it is applied and reversible afterwards.
Logon bursts on the health score
The health score watches for bursts of failed logons and drift from the baseline. A deduction is a sentence you can act on, with the fix next to it, not a red light you have to decode.
Never locked out
ServerMaid refuses any address list that leaves out the address you are connected from, and every change that could affect remote access runs with an auto-revert timer. If you cannot confirm you are still in, it undoes the change by itself.
Your rules left alone
ServerMaid's firewall rules are named so you can tell them apart. Rules created by you, your provider or other software are never rewritten, and the firewall is switched on for every profile.
Afterwards
A quiet security log and a page for your places
The attempts stop
With the port closed to the world the failed logons stop at the firewall. What is left in the security log is worth reading.
Add a location in a minute
Working from somewhere new? Open the Remote Desktop access page while connected from an allowed place, add the address with a note, press apply. It is in the firewall immediately.
Drift caught
If anything opens Remote Desktop back up behind ServerMaid's back, Repair lists the difference against the baseline and puts it right in one click.
Questions about RDP attacks on Windows Server
Should I just change the Remote Desktop port?
It helps for a few days. Scanners check every port, not only 3389, and once the new one is found the attempts resume. Limiting Remote Desktop to your own addresses removes the attack surface instead of hiding it.
Will this block my hosting provider's console?
No. The console your provider offers in its control panel does not use Remote Desktop or your server's firewall, so it keeps working. It is also the rescue route if you ever lose remote access for any other reason.
My home internet address changes. What then?
Add the new address from the Remote Desktop access page while you are still connected from an allowed one, or from another allowed location such as the office or a phone hotspot. If you are ever shut out, support can walk you through the hosting provider's console rescue.
I use a VPN to reach my servers. Does ServerMaid get in the way?
No. List the address your VPN presents to the server as an allowed place and everything else stays closed. ServerMaid never rewrites firewall rules it did not create.
What else does the security baseline cover?
SMBv1 off, the Guest account disabled, Defender real-time protection on or your own antivirus recognised, IIS request filtering, per-website NTFS permissions with nothing granted to Everyone, and the database bound to localhost with a secured root account. Every control is listed before it is applied.
Stop the password guessing today
The Server setup module builds and hardens the server in minutes, with the Remote Desktop allow list, Network Level Authentication and lockout policy applied and explained. Preview every change first.