I restricted the Firewall incoming rules for RDP under Scope to 1 Remote IP address (Local IP Address section is empty). This was done for both Public & Private/Domain Rules.
This action restricted RDP access to only my IP. I confirmed this myself by trying to access from another IP unsuccessfully, can can only access the machine from that 1 static IP.
However I still get 100s of brute force RDP attempts each day. In Event Log / Security section I consistently see other (failed) RDP attempts from other IP addresses (which appear to be external).
Logs list "Unknown user name or bad password" so that tells me that they are getting passed the firewall.
I also changed the RDP port to a custom port #, but that has not helped, I'm assuming I'm being scanned for open ports.
How can this be happening when even I cant log in from a different IP?
Could it be that attackers are somehow circumventing Windows Firewall rule?
Is there anything else that I need to disable from windows services?
Also what else can be done to prevent this?
Appreciate any help here as I'm really not sure how else to stop this, thanks!