Terminal Service Plus

Hello,

we are using RDP-Defender on our Windows Server 2008. It works well and blocks login attempts on different ports.

However, the RDP-Defender does not block multiple login attempts on the custom RDP port (we have changed the default port 3389). Such login attempts are registered in the Event Viewer, however, they don't contain information about the source (IP address is absent).

How can we configure the RDP-Defender, in order to block login attempts on our custom RDP port?

Thank you!

Can anyone help?

Hello maxxy,

RDP Defender does not directly use the RDP port.
However, as you guessed, RDP Defender does use the login attempts logged in the Event Viewer. That is why if these logs do not contain a source IP address, then RDP Defender will not be able to block it.

On Windows Server 2008, the only way to get the source IP address is to set the RDP Security Layer to RDP via Group Policy or registry key.

I just hit the same thing. I am running TSPlus on a Windows 7 Professional X64 computer using port 5903. I tried logging in 15 times with the incorrect credentials and RDP Defender didn't block the IP. I see the login error in the Event Viewer but there is no IP information.

This makes RDP Defender as useful as a screen door on a submarine. What is the fix? Above someone mentioned a registry setting but didn't give a bit of detail.

Hello,

RDS knight do support RDP port change