Can passwords be brute-forced through RDP?

Question

We had a small discussion about a security-related article at work today, and I was a bit surprised about one thing - they claim that some attackers managed to brute-force guess the password of someone and log on through RDP. The article was written with emphasis on the idea that you shouldn't leave RDP publicly available because of this.

I'm confused that it would work. Even on the most basic Windows installations there is password throttling. After 5 failed attempts there is a forced 30-second pause (or something like that). Is RDP exempt from this? Can you really try hundreds or thousands of passwords per second through RDP? I couldn't find this information on google.

Let's assume that there is no domain lock-out policy (otherwise this obviously won't work) but also that nobody has explicitly disabled any throttling that was enabled by default.

Answer 1

The lockout-on-failed-logon thing usually doesn't apply to local admin/etc. You can enable a setting that locks it out, but the default setting is that the lockout setting don't apply to admin accounts.

I'm not sure about the throttling you mention though, but it is a very common thing to see thousands of brute-force login attempts per hour on windows servers with RDP exposed to the public internet. These show up in the security event log as audit failures with event id 4625. Very often they cycle through common user names, so maybe that's how they bypass throttling ( if throttling applies to RDP).

Related: I put together a windows service a few years that firewall blocks the source IP if too many of those audit fails appear in the event log within a given time span with the same source IP. Here's a link to a short writeup on that: http://huagati.blogspot.com/2014/02/blocking-rdp-brute-force-logon-attacks.html