This means that someone is trying to find a password to access your server. How many failed login attempts do you see? The log may note thousands of failed login attempts from a single IP address. Take a look at your server's Security EventLog. Eventually they may find a password to access your server! Moreover, RDP brute-force attacks abuse server resources (CPU, RAM, Disk Space and Network Bandwidth). Network scanners and RDP brute-force tools work 24/7.

Many Windows Server machines are under constant attack. If the number of failed logon attempts from a single IP address reaches a set limit, the attacker's IP address will be blocked for a specified period of time.

It monitors the logs on your server and detects failed logon attempts. RdpGuard is a host-based intrusion prevention system (HIPS) that protects your Windows Server from brute-force attacks on various protocols and services (RDP, FTP, IMAP, POP3, SMTP, MySQL, MS-SQL, IIS Web Login, ASP.NET Web Forms, MS Exchange, RD Web Access, VoIP/SIP, etc).

Download RdpGuard 8.7.3