Blunting RDP brute-force attacks with rate limiting
blog.malwarebytes.com
blog.malwarebytes.com
There is no 'default RDP settings'. It is the security settings of the server (if an attacker tries local accounts) or the domain. Default AD DS settings are pretty lax, but whoever runs the open RDP with a default security settings deserves what would happen to him.
> this will only count as one attempt on each user
Yes, because the lockout policies are applied for user accounts, not for source IPs. Though it can be mitigated with a couple of scripts, if needed.
If someone makes 10-9999 attempts to auth in the last 10 minutes just cut them off. Even a 15 minutes ban would makes most of the bots to go away. Make the ban longer (couple of hours is enough but you can use 24h or more, if you are paranoid) and you will never see the same bot again.
You can do it even with a simple PowerShell script.
Of course the best method would be to not to expose the RDP at all (RCE is still a thing) but...