Fix RDP "Account Locked" Error and Secure your VPS (Error 0xd07)

1. Diagnosis and Root Cause

When attempting to connect to Remote Desktop (RDP), you encounter the following blocking message, even when using the correct credentials:

"As a security precaution, the user account has been locked because there were too many logon attempts or password change attempts."(Error code: 0xd07)

Why is this happening?

This lockout is a native Windows Server defense mechanism. It indicates that your VPS is currently under a Brute Force attack. Automated bots are scanning the internet and attempting thousands of password combinations on the standard Windows port (3389).

When the number of failed attempts reaches the security threshold (usually 5 to 10 attempts), Windows temporarily locks the "Administrator" account to prevent intrusion. This is why you find your account locked, often in the morning or after a period of inactivity.

2. Technical Solutions

We propose two methods to resolve this issue. Method A is a quick workaround, while Method B is the recommended security solution.

Method A: Disable Automatic Lockout (Quick Solution)

This method prevents the account from being locked but does not stop the intrusion attempts. Ensure you have an extremely strong password before proceeding.

1. Log in to your VPS (use the VNC Console in your client area if RDP is currently blocked).
2. Press Windows + R, type secpol.msc, and press Enter.
3. In the Local Security Policy window, navigate to: Account Policies > Account Lockout Policy
4. On the right side, double-click on Account lockout threshold.
5. Change the value to 0.
   • Note: The value 0 means "The account will never lock out".
6. Click Apply and then OK. The change is immediate.

Method B: Secure the RDP Port (Recommended Solution)

This method involves changing the default listening port (3389) to a custom port. This will make your server "invisible" to the majority of scanning bots.

⚠️ IMPORTANT: Please follow the steps in this exact order (Firewall first, then Registry) to avoid locking yourself out of the server.

Step 1: Open the New Port in Windows Firewall

1. Open the Start menu and search for Windows Defender Firewall with Advanced Security.
2. In the left menu, click on Inbound Rules.
3. In the right menu, click on New Rule....
4. Select the rule type Port and click Next.
5. Ensure TCP is selected. In the Specific local ports field, enter a free port number (between 10000 and 65000).
   • Recommended example: 44890
6. Click Next, select Allow the connection, then Next.
7. Check all three profiles (Domain, Private, Public) and click Next.
8. Name the rule (e.g., "RDP Custom Security") and click Finish.

Step 2: Modify the Port in Windows Registry

1. Press Windows + R, type regedit, and press Enter.
2. Navigate to the following key (you can copy-paste this path into the registry address bar): HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
3. In the list on the right, locate the value named PortNumber.
4. Double-click on it.
5. VERY IMPORTANT: Select Decimal (by default, it is Hexadecimal).
6. Replace the value 3389 with the port you opened in the firewall (e.g., 44890).
7. Click OK.

Step 3: Validation

1. Restart your VPS (via the Start menu or your client area).
2. Once the server has rebooted, your usual RDP connection will no longer work.
3. You must now specify the port after your IP address, separated by a colon.

Connection Format:

SERVER_IP:NEW_PORTExample: 82.22.77.55:44890

Need Assistance?

If you find yourself locked out following a misconfiguration, please note that you always have emergency access via the VNC / KVM Console available directly in your VeryCloud client area.

The technical team remains at your disposal.