Block RDP brute-force with RDPGuard or EvlWatcher

Introduction

A Windows VPS exposed on the Internet receives thousands of RDP attempts per day from bots. Without protection, you risk:

• Administrator account lockout (error 0xd07)
• Password dictionary compromise
• Permanent CPU/network load

Two reference solutions exist:

• EvlWatcher: 100% free, open-source, based on Windows Event Logs analysis
• RDPGuard: commercial (~€80), 30-day trial, more polished interface

This guide covers both installations.

Prerequisites

• Windows Server 2019, 2022 or 2025 VPS
• Administrator access via RDP
• Windows Firewall enabled

Option A: EvlWatcher (free)

Step 1: Download

Download the latest release from GitHub:

https://github.com/devnulli/EvlWatcher/releases

Get the EvlWatcher.x.x.x.zip file.

Step 2: Install

1. Extract the archive into C:\Program Files\EvlWatcher\
2. Right-click on EvlWatcherService.exe → Run as administrator
3. On first launch, the service installs automatically into Windows

Check in services.msc:

• Look for EvlWatcher Service
• Status: Running
• Type: Automatic

Step 3: Configuration

Open C:\Program Files\EvlWatcher\config.xml (as administrator).

Main parameters:

<config>
  <generalsettings>
    <!-- Max IPs watched in RAM -->
    <maxipsinmemory>10000</maxipsinmemory>
    
    <!-- Detailed logging for debug -->
    <loglevel>INFO</loglevel>
  </generalsettings>

  <tasks>
    <task name="RDP">
      <!-- Event source: Windows Security logs -->
      <eventlog>Security</eventlog>
      
      <!-- Regex patterns to detect failed RDP attempts -->
      <events>4625</events>
      
      <!-- Failed attempts before ban -->
      <permanentban>10</permanentban>
      <temporaryban>3</temporaryban>
      
      <!-- Temporary ban duration (seconds, here 1h) -->
      <temporarybanduration>3600</temporarybanduration>
    </task>
  </tasks>
</config>

Step 4: Whitelist

To never ban your fixed IP (critical to avoid locking yourself out):

<whitelist>
  <ip>82.26.157.10</ip>
  <ip>192.168.1.0/24</ip>
</whitelist>

Restart the service:

Restart-Service EvlWatcherService

Step 5: GUI (optional)

Launch EvlWatcherGUI.exe (as administrator) to see:

• Currently banned IPs
• Attempt history
• Blocking statistics

Step 6: Verify operation

Inspect the Windows Firewall:

Get-NetFirewallRule -DisplayName "EvlWatcher*" | Select-Object DisplayName, Enabled

You should see EvlWatcher Block IP X.X.X.X rules created automatically.

Option B: RDPGuard (commercial)

Step 1: Download

Download the installer from: https://www.rdpguard.com

Run rdpguard_setup.exe as administrator.

Step 2: Install

Next → Next → Finish. RDPGuard installs as a Windows service and starts automatically.

The GUI opens. You have 30 days of free evaluation with all features.

Step 3: Configuration

In the Settings → Protocols tab, enable:

• RDP (Remote Desktop): protects the RDP port
• SMTP: if you have a mail server
• FTP: if you have an FTP server
• MS SQL: if you have SQL Server exposed

For each protocol, set:

• Number of failed login attempts before IP is blocked: 5
• Block IP address for: 3600 seconds (1 hour)

Step 4: Whitelist

Settings → IP Whitelist → Add. Add your trusted IPs to never be blocked.

Step 5: Notifications

Settings → Notifications: configure email sending on each block.

Step 6: Permanent license

After 30 days, purchase a license from the official site or uninstall RDPGuard and switch to EvlWatcher.

Troubleshooting

Service won't start

Inspect Windows Event Logs:

Get-EventLog -LogName Application -Source "EvlWatcher*" -Newest 20

Check permissions of config.xml (read access for the service).

No IP banned after several hours

Verify that Windows audits failed logins:

auditpol /get /subcategory:"Logon"

Should display Success and Failure. If not:

auditpol /set /subcategory:"Logon" /success:enable /failure:enable

You're locked out after a test

Log in via noVNC from the VeryCloud customer area (the console connection doesn't go through RDP, so it will never be blocked).

Remove the firewall rule blocking you:

Get-NetFirewallRule -DisplayName "*BLOCK*" | Where-Object { $_.DisplayName -like "*YOUR_IP*" } | Remove-NetFirewallRule

Complementary best practices

Beyond auto-ban, secure your RDP:

1. Change the RDP port (3389 → custom port between 10000 and 65000). See VeryCloud guide RDP Error 0xd07.
2. Disable the default Administrator account, create an admin account with another name.
3. Force 2FA authentication with a tool like DUO Security.
4. Limit RDP to your fixed IPs via Windows Firewall.

Useful commands (PowerShell)

# EvlWatcher service status
Get-Service EvlWatcherService

# Restart the service
Restart-Service EvlWatcherService

# List all RDP block rules
Get-NetFirewallRule -DisplayName "*EvlWatcher*"

# List failed RDP events from last 24h
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=(Get-Date).AddDays(-1)} | Format-Table TimeCreated, @{Name='IP';Expression={$_.Properties[19].Value}}

# Count attempts per IP
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=(Get-Date).AddDays(-1)} | Group-Object {$_.Properties[19].Value} | Sort-Object Count -Descending

Conclusion

EvlWatcher (free) is largely sufficient for personal or small business use. RDPGuard is interesting if you manage multiple servers and need a centralized interface or advanced features (PDF reports, AD integration).

In any case, never leave a Windows VPS in production without brute-force protection: it's the number one cause of compromise on Windows servers.

Resources

• EvlWatcher GitHub: https://github.com/devnulli/EvlWatcher
• RDPGuard: https://www.rdpguard.com
• VeryCloud guide — RDP Error 0xd07: https://verycloud.fr/docs/article/rdp-fix-login
• VeryCloud guide — Windows port opening: https://verycloud.fr/docs/article/windows-firewall