Vytvorenie pravidla na firewall:<\/p>\n\n\n\n
New-NetFirewallRule -DisplayName \"BlockRDPBruteForce\" \u2013RemoteAddress 1.1.1.1 -Direction Inbound -Protocol TCP \u2013LocalPort 3389 -Action Block<\/code><\/pre>\n\n\n\nScript ktory zabezpeci nacitanie IP ktore zadali 3x zle heslo a nasledne ich zablokuje cez FW:<\/p>\n\n\n\n
$Last_n_Hours = [DateTime]::Now.AddHours(-5)\n$badRDPlogons = Get-EventLog -LogName 'Security' -after $Last_n_Hours -InstanceId 4625 | ?{$_.Message -match 'logon type:\\s+(3)\\s'} | Select-Object @{n='IpAddress';e={$_.ReplacementStrings[-2]} }\n$getip = $badRDPlogons | group-object -property IpAddress | where {$_.Count -gt 5} | Select -property Name\n\n\n$log = \"C:\\rdp_blocked_ip.txt\"\n$current_ips = (Get-NetFirewallRule -DisplayName \"BlockRDPBruteForce\" | Get-NetFirewallAddressFilter ).RemoteAddress\nforeach ($ip in $getip)\n{\n$current_ips += $ip.name\n(Get-Date).ToString() + ' ' + $ip.name + ' The IP address has been blocked due to ' + ($badRDPlogons | where {$_.IpAddress -eq $ip.name}).count + ' attempts for 2 hours'>> $log # writing the IP blocking event to the log file\n}\nSet-NetFirewallRule -DisplayName \"BlockRDPBruteForce\" -RemoteAddress $current_ips\n\nDany PS1 script je potrebne spustat cez sheduller <\/code><\/pre>\n \t