How to protect your Administrator account from brute-force lockout

#ps1
# BEGINNING OF THE CONFIGURATION SECTION
 
# When an RDP port is exposed to the Internet, it may be a target of brute-force attacks.
# This may lead to the Administrator account lockout. This script is intended to prevent this scenario.
# You may amend the script in accordance with your requirements.
# To enable settings you need, remove the octothorpe (#) symbol from the beginning of that line.
 
# Renames the built-in Administrator account.
# Make sure that your software / scripts support the built-in Administrator account having a non-default name.
 
    # $AdministratorAccountLoginName = 'ExampleNewLoginName'
 
# A new RDP port number instead of the default 3389.
# Enabling this parameter triggers an additional reboot during server installation.
 
    # $RDPPort = 3403
 
# Restricts RDP access only to trusted IP addresses.
# This parameter is recommended when you connect to the server from static IP addresses.
# Do not use if your RDP clients use dynamic IP addresses.
# You can specify here a range of IP addresses that your ISP allocated to you.
 
    # $TrustedClients = @('10.0.0.0/8', '192.0.2.1')
 
# Disables lockout for the built-in Administrator account.
# Reverts OS behaviour to pre-KB5020282 when dealing with brute-force attacks to the Administrator account.
# We do not recommend you enable this setting, since it reduces security of your system.
# Instead we recommend you to create new separate administrator accounts.

    # $DisableAdministratorAccountLockout = $true
    
# Disables Remote Desktop server.
# We recommend you to enable this setting if you access your server only via WinRM, SSH, or some other protocol that is not RDP.
# This setting takes precedence over the RDP port and trusted clients settings.
 
    # $DisableRemoteDesktop = $true
 
# END OF THE CONFIGURATION SECTION
 
#Requires -Version 5

if ($AdministratorAccountLoginName) {
    $BuiltInAdministrator = Get-LocalUser | Where-Object -FilterScript { $_.SID -like 'S-1-5-21-*-500' }
    Rename-LocalUser -InputObject $BuiltInAdministrator -NewName $AdministratorAccountLoginName
}
 
if ($DisableAdministratorAccountLockout) {
    $SecurityPolicyTempFileName = Join-Path -Path $env:TEMP -ChildPath (New-Guid).Guid
    $SecurityDBTempFileName = Join-Path -Path $env:TEMP -ChildPath (New-Guid).Guid
    secedit /export /cfg $SecurityPolicyTempFileName /quiet
    (Get-Content -Path $SecurityPolicyTempFileName).Replace('AllowAdministratorLockout = 1', 'AllowAdministratorLockout = 0') | Set-Content -Path $SecurityPolicyTempFileName
    secedit /configure /db $SecurityDBTempFileName /cfg $SecurityPolicyTempFileName /areas SECURITYPOLICY /quiet
    Remove-Item -Path $SecurityPolicyTempFileName -Force
    Remove-Item -Path $SecurityDBTempFileName -Force
}
 
if ($DisableRemoteDesktop) {
    Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' -Name 'fDenyTSConnections' -Value 1 -Force
    Set-NetFirewallRule -Name 'RemoteDesktop-UserMode-In-TCP' -Enabled False
    Set-NetFirewallRule -Name 'RemoteDesktop-UserMode-In-UDP' -Enabled False
}
else {
    if ($TrustedClients -or $RDPPort) {
        $SetNetFirewallRuleParameters = @{}
 
        if ($TrustedClients) {
            $SetNetFirewallRuleParameters.Add('RemoteAddress', $TrustedClients)
        }
        if ($RDPPort) {
            $SetNetFirewallRuleParameters.Add('LocalPort', $RDPPort)
        }
 
        Set-NetFirewallRule -Name 'RemoteDesktop-UserMode-In-TCP' -Enabled True @SetNetFirewallRuleParameters
        Set-NetFirewallRule -Name 'RemoteDesktop-UserMode-In-UDP' -Enabled True @SetNetFirewallRuleParameters
 
        if ($RDPPort) {
            Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name 'PortNumber' -Value $RDPPort -Force
            # Exit code 1001 triggers cloudbase-init to reboot the host after finishing userscripts plugin and not run it again after the reboot.
            exit 1001
        }
    }
}