Hardening Windows RDP Against Ransomware and Brute-Force Attacks: Deploying IPBan, NLA Enforcement, and Account Lockout Policies in Pakistan

Windows Remote Desktop Protocol (RDP) on TCP port 3389 remains one of the primary initial access vectors targeted by global ransomware syndicates, cryptomining botnets, and credential-stuffing campaigns.^[1][2] In Pakistan, thousands of freelancers, software houses, call centers, and accounting firms deploy cloud VPS instances and bare-metal dedicated servers running Windows Server or Windows 11 Enterprise with default security configurations.^[1]

Within minutes of provisioning an Internet-facing Windows server with a public IPv4 address, automated scanners (such as masscan and zmap) detect the listening RDP port.^[1] Botnets immediately launch sustained dictionary attacks, bombarding the Local Security Authority Subsystem Service (lsass.exe) with hundreds of authentication attempts per second.^[1]

This unrelenting traffic produces three critical failures:^[1][2]

1. CPU Exhaustion: lsass.exe and Cryptographic Services consume 80% to 100% of available CPU cycles processing cryptographic handshakes, freezing legitimate remote desktop sessions.^[1]
2. Denial-of-Service via Account Lockout: If standard account lockout policies are enabled without an automated IP banning mechanism, attackers intentionally spray invalid passwords against known usernames (Administrator), triggering lockout events (Event ID 4740) that lock out legitimate system administrators.^[2]
3. Ransomware Breach: Weak passwords or credential reuse inevitably result in full administrator compromise, leading to total data encryption (LockBit, BlackCat/ALPHV) and complete operational shutdown.^[1]

This runbook delivers an enterprise-grade defense architecture to harden Windows RDP environments in Pakistan using IPBan (an open-source automated intrusion prevention service for Windows), Network Level Authentication (NLA) enforcement, and fine-grained account lockout thresholds.^[1][3]

---

Layered Defense Architecture for Internet-Facing RDP

The table below contrasts standard default Windows RDP installations with a production-hardened multi-tier defense architecture.^[1][2][3]

Security Control	Default Windows Installation	Production-Hardened Architecture	Protection Impact
Port & Exposure	Static TCP Port 3389 open to 0.0.0.0/0	Obfuscated Port + Perimeter Firewall Scoping	Eliminates 95% of basic automated internet-wide port sweeps
Pre-Authentication	Standard RDP negotiation enabled	Mandatory Network Level Authentication (NLA)[1]	Requires CredSSP credentials before spawning user desktop sessions
Intrusion Prevention	No native rate-limiting or IP banning	Automated IPBan Service with Windows Defender Firewall integration[3]	Automatically drops malicious IP addresses at kernel packet level after 3–5 failures
Account Policies	Unlimited failed attempts (or unmanaged lockout)[2]	Lockout threshold of 5 attempts + Administrator lockout protection[2]	Prevents brute-force dictionary attacks while preserving console recovery
Identity Hygiene	Default “Administrator” account active	Built-in Administrator renamed; unprivileged daily users	Defeats 99% of hardcoded brute-force dictionary lists

---

Step 1: Auditing Security Event Logs (Event ID 4625)

To confirm whether your Windows Server is currently experiencing an ongoing brute-force attack, inspect the Windows Security Log for Event ID 4625 (An account failed to log on).^[1]

Execute this PowerShell command in an elevated prompt:^[1]

# Query the last 20 failed logon attempts from RDP or Network logons
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625} -MaxEvents 20 | ForEach-Object {
    $xml = [xml]$_.ToXml()
    $eventData = $xml.Event.EventData.Data
    [PSCustomObject]@{
        TimeCreated  = $_.TimeCreated
        TargetUser   = ($eventData | Where-Object { $_.Name -eq 'TargetUserName' }).'#text'
        IpAddress    = ($eventData | Where-Object { $_.Name -eq 'IpAddress' }).'#text'
        LogonType    = ($eventData | Where-Object { $_.Name -eq 'LogonType' }).'#text'
        SubStatus    = ($eventData | Where-Object { $_.Name -eq 'SubStatus' }).'#text'
    }
} | Format-Table -AutoSize

Sample output confirming an active brute-force campaign:

TimeCreated           TargetUser    IpAddress       LogonType SubStatus
-----------           ----------    ---------       --------- ---------
08/11/2026 18:42:01   admin         185.220.101.42  3         0xc000006a
08/11/2026 18:42:02   administrator 185.220.101.42  3         0xc000006a
08/11/2026 18:42:03   user          185.220.101.42  3         0xc000006a
08/11/2026 18:42:04   guest         185.220.101.42  3         0xc0000064

• LogonType: 3: Indicates a network logon (CredSSP / NLA pre-authentication attempt).^[1]
• SubStatus: 0xc000006a: Incorrect password entered.^[1]
• SubStatus: 0xc0000064: The user account does not exist.^[1]

---

Step 2: Enforcing Network Level Authentication (NLA)

Network Level Authentication requires connecting clients to authenticate their identity using Credential Security Support Provider (CredSSP) before the server initializes the full graphical RDP subsystem, GDI display driver, and user desktop environment.^[1] This dramatically reduces server-side memory allocation and CPU consumption during attack waves.^[1]

Enforcing NLA via PowerShell

# Set UserAuthentication to 1 (Required) on RDP-Tcp terminal station
Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' `
  -Name 'UserAuthentication' -Value 1 -Type DWord

# Ensure Remote Desktop is enabled
Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' `
  -Name 'fDenyTSConnections' -Value 0 -Type DWord

---

Step 3: Deploying IPBan for Automated Firewall Blocking

While NLA prevents unauthenticated desktop spawning, lsass.exe must still evaluate the password for every CredSSP attempt.^[1] To prevent CPU exhaustion and credential spraying, deploy IPBan, an open-source Windows intrusion prevention engine that intercepts Event ID 4625 in real time and automatically creates Windows Defender Firewall block rules.^[3]

1. Automated Installation via PowerShell

Open an administrative PowerShell console on your Windows Server:^[3]

# Define download and installation directory
$InstallDir = "C:\Program Files\IPBan"
$ZipUrl = "https://github.com/DigitalRuby/IPBan/releases/download/1.15.1/IPBan-Windows-x64.zip"
$ZipFile = "$env:TEMP\IPBan.zip"

# Download official IPBan release package
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
Invoke-WebRequest -Uri $ZipUrl -OutFile $ZipFile

# Extract files to installation directory
If (!(Test-Path $InstallDir)) { New-Item -Path $InstallDir -ItemType Directory -Force }
Expand-Archive -Path $ZipFile -DestinationPath $InstallDir -Force

# Install and register the IPBan Windows Service
Set-Location $InstallDir
.\IPBan.exe install

2. Hardening ipban.config

Open C:\Program Files\IPBan\ipban.config in an editor. Configure the following parameters:^[3]

<!-- Number of failed logons before an IP is blocked -->
<add key="FailedLoginAttemptsBeforeBan" value="3" />

<!-- Time window in which failed attempts must occur -->
<add key="FailedLoginAttemptsWindow" value="00:15:00" />

<!-- Duration of the firewall ban (00:00:00 = permanent, or set to 24 hours) -->
<add key="BanTime" value="24:00:00" />

<!-- Whitelist your office fixed IP or local subnets -->
<add key="Whitelist" value="127.0.0.1,::1,192.168.1.0/24,39.40.0.0/16" />

<!-- Firewall rule prefix in Windows Defender Firewall -->
<add key="FirewallRulePrefix" value="BlockIPBan_" />

Start the service and configure automatic startup:^[3]

Set-Service -Name IPBan -StartupType Automatic
Start-Service -Name IPBan
Get-Service -Name IPBan

3. Verifying Active Firewall Blocking

Once IPBan is active, inspect the Windows Defender Firewall rules created under BlockIPBan_0:^[3]

# Inspect active IPBan firewall rules
Get-NetFirewallRule -DisplayName "BlockIPBan_*" | Format-Table DisplayName, Direction, Action, Enabled

Attacking IP addresses are now immediately blacklisted at the network layer upon reaching 3 failed attempts, eliminating CPU load on lsass.exe and neutralizing dictionary bots instantly.^[3]

---

Step 4: Configuring Account Lockout Thresholds

In conjunction with IPBan, configure Windows Account Lockout Policies to prevent offline or distributed slow-spraying attacks.^[2]

Execute via administrative command prompt or PowerShell:^[2]

# Set account lockout threshold to 5 attempts
net accounts /lockoutthreshold:5

# Set lockout duration to 30 minutes
net accounts /lockoutduration:30

# Set reset lockout counter window to 30 minutes
net accounts /lockoutwindow:30

# Verify active account policies
net accounts

Under Windows Server 2022 and Windows Server 2025, ensure that the built-in Administrator account lockout protection is active, which protects the built-in RID-500 account from network-based brute-force attacks while preserving local console accessibility.^[2]

---

Step 5: Identity Hygiene and Obfuscation

1. Rename Built-In Administrator: Automated dictionary tools specifically target the default username Administrator. Renaming it forces attackers to guess both the username and the password.^[1]

   # Rename the built-in administrator account
   Rename-LocalUser -Name "Administrator" -NewName "SvcSecOpsAdmin"

2. Create a Dedicated Unprivileged Remote Desktop User: Do not use administrative credentials for daily development tasks. Create a standard user member of the Remote Desktop Users group for routine workstation access, and elevate with User Account Control (UAC) only when necessary.^[1]

---

Enterprise Sovereign Infrastructure for Secure Remote Workstations

While software-level intrusion prevention shields Windows servers from opportunistic attacks, organizations managing financial transactions, healthcare records, and enterprise ERP systems require hardware isolation and sovereign perimeter protection.^[1][3]

Deploying mission-critical Windows workstations and multi-session Remote Desktop Session Hosts on enterprise dedicated server hosting and sovereign dedicated Pakistan servers provides isolated hardware boundaries, private out-of-band IPMI/iDRAC management, and unmetered connectivity within premier Pakistani datacenters, eliminating shared hypervisor exposure and foreign surveillance vulnerabilities.

Sources & Official References

1. Microsoft Learn — Audit Logon: Event ID 4625 Reference

   Official technical reference detailing Windows Security Event 4625 logon types, sub-status error codes, CredSSP pre-authentication logging, and failure telemetry.

2. Microsoft Learn — Account Lockout Threshold Security Policy Settings

   Official Windows security guide detailing account lockout configuration, lockout duration parameters, administrator account mitigation, and brute-force defenses.

3. DigitalRuby IPBan — Automated Intrusion Prevention and Firewall Ban Service for Windows

   Official open-source documentation and repository for IPBan, configuring automated Event Viewer log ingestion, dynamic Windows Defender Firewall rule synthesis, and whitelist policies.