RDP Guard

RDP Guard monitors failed RDP sign-in attempts in the Windows Security log and blocks abusive remote IP addresses through Windows Firewall.

Defaults

• Event ID: 4625
• LogonType: 3 or 10
• Threshold: 3 or more audit failures
• Check interval: 15 minutes
• Firewall rule name: RDP_GUARD_yyyyMMdd_HHmmss_fff
• If a check finds IPs to block, all of them are written into a single inbound firewall rule using the rule remoteip scope.
• If an IP is already covered by an active broad inbound block rule, it is not added to a new RDP_GUARD_... rule.
• Whitelist defaults: 127.0.0.1, ::1
• The app starts minimized to the system tray. Left-click opens the window; right-click shows open/check/start-stop/exit actions.
• Default language: English. Selected language is saved in config. Supported languages: English, Turkish, German, Russian, French, Spanish, Chinese.

Build

.\build.ps1

Output:

bin\Release\RDPGuard.exe

The executable requires administrator privileges via manifest. The "start with Windows" option creates a Task Scheduler entry named RDP Guard with RunLevel=Highest.

RDP Guard does not analyze or block successful RDP logons. It only counts Security log 4625 failure events that contain a remote IP and match RDP/NLA-related logon types.

When closing the window, the app offers two choices: Minimize to tray or Close program.

Stability Notes

• netsh, PowerShell, and schtasks calls use timeout handling and async output reading so a stuck system command does not freeze the app indefinitely.
• RDP Guard only updates or deletes its own safely named RDP_GUARD_... rules.
• If config state and actual firewall state diverge, the next check revalidates the record.
• Logs are written to C:\ProgramData\RDPGuard\rdpguard.log and rotated above 2 MB.
• Language selection only affects UI text. Event scanning, IP handling, firewall logic, counters, and time intervals are language-independent.
• On startup, RDP Guard attempts to raise its process priority to High, logs unhandled exceptions, and registers with Windows application restart for better background resilience.
• Debug logging is always bounded: rdpguard.log is capped at 2 MB and up to 4 rotated files are retained. Lines include timestamp, level, PID, thread ID, uptime, startup snapshot, check IDs, scan/firewall timings, process exit codes, and exception stack traces.

RDP Guard

RDP Guard, Windows Security log icindeki basarisiz RDP oturum acma denemelerini izler ve kotuye kullanim yapan uzak IP adreslerini Windows Firewall uzerinden engeller.

Varsayilanlar

• Event ID: 4625
• LogonType: 3 veya 10
• Esik: 3 veya daha fazla audit failure
• Kontrol araligi: 15 dakika
• Firewall kural adi: RDP_GUARD_yyyyMMdd_HHmmss_fff
• Her kontrol turunda engellenecek IP varsa hepsi tek inbound firewall kuralina yazilir; IP'ler kuralin remoteip scope listesine eklenir.
• IP zaten aktif ve genel kapsamli bir inbound block firewall kuralinin remote scope'u tarafindan kapsaniyorsa yeni RDP_GUARD_... kuralina eklenmez.
• Whitelist varsayilanlari: 127.0.0.1, ::1
• Uygulama ilk acilista sistem tepsisine/gizli simgelere kucultulmus baslar. Sol tik pencereyi acar; sag tik ac/kontrol et/baslat-durdur/kapat seceneklerini gosterir.
• Varsayilan dil: English. Secilen dil config icinde saklanir. Desteklenen diller: Ingilizce, Turkce, Almanca, Rusca, Fransizca, Ispanyolca, Cince.

Build

.\build.ps1

Cikti:

bin\Release\RDPGuard.exe

Exe manifest ile yonetici yetkisi ister. "Windows ile baslat" secenegi, Task Scheduler icinde RDP Guard adli gorevi RunLevel=Highest olarak olusturur.

RDP Guard basarili RDP girislerini analiz etmez veya bloklamaz. Yalnizca Security log altindaki, uzak IP alanina sahip ve RDP/NLA ile ilgili logon tiplerine uyan 4625 basarisiz oturum acma olaylarini sayar.

Pencere kapatilirken iki secenek sunulur: Simge durumuna kucult veya Programi kapat.

Kararlilik Notlari

• netsh, PowerShell ve schtasks cagrilari timeout ve async output okuma ile calisir; takilan sistem komutu uygulamayi sonsuza kadar dondurmez.
• RDP Guard yalnizca guvenli RDP_GUARD_... ad formatindaki kendi kurallarini gunceller veya siler.
• Config ile gercek firewall durumu ayrisirsa bir sonraki kontrolde kayit yeniden dogrulanir.
• Loglar C:\ProgramData\RDPGuard\rdpguard.log altinda tutulur ve 2 MB uzerinde rotate edilir.
• Dil secimi yalnizca UI/metin katmanini etkiler. Event tarama, IP islemleri, firewall mantigi, sayaclar ve zaman araliklari dil ayarindan bagimsizdir.
• RDP Guard acilista islem onceligini High yapmayi dener, yakalanmamis hatalari loglar ve arka plan kararliligi icin Windows application restart kaydi olusturur.
• Debug log boyutu sinirlidir: rdpguard.log 2 MB ile sinirlanir ve en fazla 4 rotate dosyasi tutulur. Satirlarda zaman, seviye, PID, thread ID, uptime, startup ozeti, kontrol ID'leri, scan/firewall sureleri, process exit code'lari ve exception stack trace'leri bulunur.