Windows RDP

Every failed Windows logon is written to the Security event log as event 4625, with the source address. This PowerShell script reports addresses with ten or more failures in the last hour.

The script

Save it as C:\Scripts\isipsafe-rdp.ps1:

$Key = 'sl_your_key_here'   # optional
$Since = (Get-Date).AddHours(-1)

Get-WinEvent -FilterHashtable @{ LogName = 'Security'; Id = 4625; StartTime = $Since } -ErrorAction SilentlyContinue |
  ForEach-Object { ([xml]$_.ToXml()).Event.EventData.Data | Where-Object Name -eq 'IpAddress' | ForEach-Object '#text' } |
  Where-Object { $_ -match '^[0-9a-fA-F.:]+$' -and $_ -ne '127.0.0.1' -and $_ -ne '::1' } |
  Group-Object | Where-Object Count -ge 10 |
  ForEach-Object {
    Invoke-RestMethod -Method Post -Uri "https://isipsafe.com/api/v1/report?key=$Key" -Body @{
      ip         = $_.Name
      categories = 'rdp,brute-force'
      comment    = "RDP: $($_.Count) failed logons in 1h"
    } | Out-Null
  }

Run it every hour

From an elevated prompt (reading the Security log needs administrator rights):

schtasks /create /tn "isipsafe RDP reporter" /tr "powershell -NoProfile -ExecutionPolicy Bypass -File C:\Scripts\isipsafe-rdp.ps1" /sc hourly /ru SYSTEM

Tips

• If the IpAddress field is often -, Network Level Authentication is rejecting connections before Windows logs the source. That is good for security; the remaining entries are still worth reporting.
• RDP should not be open to the internet at all if you can avoid it. Put it behind a VPN or an RD Gateway.

Need a hand?

If something here does not work with your version of Windows RDP, or you have improved it, tell us. We update these pages with what people send.

Windows RDP and its logo are trademarks of their respective owners. isipsafe is not affiliated with or endorsed by them.