> including the default settings for RDP I believe There is no 'default RDP settings'. It is the security settings of the server (if an attacker tries local ac

> including the default settings for RDP I believe There is no 'default RDP settings'. It is the security settings of the server (if an attacker tries local accounts) or the domain. Default AD DS settings are pretty lax, but whoever runs the open RDP with a default security settings deserves what would happen to him. > this will only count as one attempt on each user Yes, because the lockout policies are applied for user accounts, not for source IPs. Though it can be mitigated with a couple of scripts, if needed.