There are a lot of attempts to brute for 3389 RDP and 5900 VNC, I see them on all my nodes tarpit rules. For completeness sake I should add that people should

There are a lot of attempts to brute for 3389 RDP and 5900 VNC, I see them on all my nodes tarpit rules. For completeness sake I should add that people should not depend on this blocking as the 10 minute account lockouts will only stop targeted attacks and not all the bots. Some of the better written bots ...admittedly there are not many, distribute their attempts across many targets reducing the probability of a lockout. For clarity what I mean is that they might brute force several hundred thousand IP addresses they found 3389 open on but only hit each unique IP once every {interval based on number of targets}. In my opinion the windows machines should be behind a VPN or at least a firewall that restricts access to known CIDR blocks to limit the number of bots that could reach it. Another option that will take away the non-targeted bots is the same method used by many in SSH and that is to change the listening port for RDP. [1] This is security through obscurity and works like a charm when putting nodes behind a VPN is just not possible. e.g. change 3389 to something like 33389. This will not stop a determined attacker but will most certainly cut out 99+% of the bots and remove logging most events and reduce risk of alert fatigue. This will also keep the non-targeted bots from locking out your accounts and creating support headaches. To see what ports nmap scans by default i.e. ports to avoid on a modern version of nmap, use: nmap -v -oG - | grep "Ports scanned" Another mitigating control is to use names that bots would never guess from their dictionaries and lock out all default windows accounts. e.g. instead of bill.gates consider an uncommon nickname such as sillybilly. There are additional privacy benefits to this such as keeping your name out of the myriad of application telemetry API's. And lastly if you don't RDP into your machines then make sure remote desktop and all other remote access services are disabled. Check what is listening with netstat -nabo Or use tcpview from the SysInternals tools from Microsoft [2] too see what is listening or talking on your windows machine. Use care when "locking down" a windows machine. There are many powershell scripts on github that are excessive and may break your machine. Always back up your registry and create a restore point if you intend to make changes to the registry. [1] - https://docs.microsoft.com/en-us/windows-server/remote/remote-desktop-services/clients/change-listening-port https://docs.microsoft.com/en-us/windows-server/remote/remot... [2] - https://docs.microsoft.com/en-us/sysinternals/downloads/ https://docs.microsoft.com/en-us/sysinternals/downloads/