I have often been told that allowing RDP access over the internet is a security risk - my understanding is that this logic stems from the idea that a potential hacker would brute-force the username and password in order to gain access. For instance, see this article.
Recently I had a call with Microsoft and they told me that this is not actually a security risk because the RDP protocol has a built-in protection against brute force and will automatically disable itself if too many attempts are made to access it (although I have not been able to independently verify that this is actually the case). Regardless, we can assume that any server who can be accessed via RDP over the internet has an account lockout policy (which will lock-out an account after 20 failed attempts).
Assuming that all users have a extremely strong, randomly generated passwords, where is the vulnerability of accessing a server using RDP over the internet? And how is this less secure than having a VPN which authenticates via a RADIUS server using Active Directory (aka the same user-store as we are using to RDP into a specific server).
p.s. Some people have suggested that changing the RDP port may increase security - but would this even be necessary given the above? If there is a security risk, couldn't a potential hacker user a port scanner to determine which port IS being used for RDP?