We had a small discussion about a security-related article at work today, and I was a bit surprised about one thing - they claim that some attackers managed to brute-force guess the password of someone and log on through RDP. The article was written with emphasis on the idea that you shouldn't leave RDP publicly available because of this.
I'm confused that it would work. Even on the most basic Windows installations there is password throttling. After 5 failed attempts there is a forced 30-second pause (or something like that). Is RDP exempt from this? Can you really try hundreds or thousands of passwords per second through RDP? I couldn't find this information on google.
Let's assume that there is no domain lock-out policy (otherwise this obviously won't work) but also that nobody has explicitly disabled any throttling that was enabled by default.