How to protect your Administrator account from brute-force lockout

By default, Windows exposes its RDP port to the Internet. That's why it becomes an attractive target for brute-force attacks. When an attack occurs, the Administrator account may be blocked after numerous attempts to log in by the attacker. If this happens, you could lose access to the server until the issue is resolved.

To prevent this happening, we recommend you use our PowerShell script that changes default RDP settings and makes it difficult for attackers to target you with malicious activity.

The script consists of two blocks:

  1. A configuration section that allows you to configure the script's behavior

  2. The actual code doing all the work (do not modify this)

You can enable any options you need by removing the octothorpe sign (#) from the beginning of the line that you want to enable.

The script should be inserted into the User data field while ordering a server or reinstalling an operating system. All parameters are described in the script below as comments.

The script is designed and applicable only for Windows Server 2016, 2019, 2022 Standard and Datacenter editions.

User data script: Windows administrator issue solution

# When an RDP port is exposed to the Internet, it may be a target of brute-force attacks.
# This may lead to the Administrator account lockout. This script is intended to prevent this scenario.
# You may amend the script in accordance with your requirements.
# To enable settings you need, remove the octothorpe (#) symbol from the beginning of that line.
# Renames the built-in Administrator account.
# Make sure that your software / scripts support the built-in Administrator account having a non-default name.
    # $AdministratorAccountLoginName = 'ExampleNewLoginName'
# A new RDP port number instead of the default 3389.
# Enabling this parameter triggers an additional reboot during server installation.
    # $RDPPort = 3403
# Restricts RDP access only to trusted IP addresses.
# This parameter is recommended when you connect to the server from static IP addresses.
# Do not use if your RDP clients use dynamic IP addresses.
# You can specify here a range of IP addresses that your ISP allocated to you.
    # $TrustedClients = @('', '')
# Disables lockout for the built-in Administrator account.
# Reverts OS behaviour to pre-KB5020282 when dealing with brute-force attacks to the Administrator account.
# We do not recommend you enable this setting, since it reduces security of your system.
# Instead we recommend you to create new separate administrator accounts.

    # $DisableAdministratorAccountLockout = $true
# Disables Remote Desktop server.
# We recommend you to enable this setting if you access your server only via WinRM, SSH, or some other protocol that is not RDP.
# This setting takes precedence over the RDP port and trusted clients settings.
    # $DisableRemoteDesktop = $true
#Requires -Version 5

if ($AdministratorAccountLoginName) {
    $BuiltInAdministrator = Get-LocalUser | Where-Object -FilterScript { $_.SID -like 'S-1-5-21-*-500' }
    Rename-LocalUser -InputObject $BuiltInAdministrator -NewName $AdministratorAccountLoginName
if ($DisableAdministratorAccountLockout) {
    $SecurityPolicyTempFileName = Join-Path -Path $env:TEMP -ChildPath (New-Guid).Guid
    $SecurityDBTempFileName = Join-Path -Path $env:TEMP -ChildPath (New-Guid).Guid
    secedit /export /cfg $SecurityPolicyTempFileName /quiet
    (Get-Content -Path $SecurityPolicyTempFileName).Replace('AllowAdministratorLockout = 1', 'AllowAdministratorLockout = 0') | Set-Content -Path $SecurityPolicyTempFileName
    secedit /configure /db $SecurityDBTempFileName /cfg $SecurityPolicyTempFileName /areas SECURITYPOLICY /quiet
    Remove-Item -Path $SecurityPolicyTempFileName -Force
    Remove-Item -Path $SecurityDBTempFileName -Force
if ($DisableRemoteDesktop) {
    Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' -Name 'fDenyTSConnections' -Value 1 -Force
    Set-NetFirewallRule -Name 'RemoteDesktop-UserMode-In-TCP' -Enabled False
    Set-NetFirewallRule -Name 'RemoteDesktop-UserMode-In-UDP' -Enabled False
else {
    if ($TrustedClients -or $RDPPort) {
        $SetNetFirewallRuleParameters = @{}
        if ($TrustedClients) {
            $SetNetFirewallRuleParameters.Add('RemoteAddress', $TrustedClients)
        if ($RDPPort) {
            $SetNetFirewallRuleParameters.Add('LocalPort', $RDPPort)
        Set-NetFirewallRule -Name 'RemoteDesktop-UserMode-In-TCP' -Enabled True @SetNetFirewallRuleParameters
        Set-NetFirewallRule -Name 'RemoteDesktop-UserMode-In-UDP' -Enabled True @SetNetFirewallRuleParameters
        if ($RDPPort) {
            Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name 'PortNumber' -Value $RDPPort -Force
            # Exit code 1001 triggers cloudbase-init to reboot the host after finishing userscripts plugin and not run it again after the reboot.
            exit 1001


Suggested Articles

  • Windows administration

    How to configure network on Windows Server 2012

  • Windows administration

    How to provide the technical support team with network diagnostic results