I've seen this same question discussed for unix style servers- such as here Is it normal to get hundreds of break-in attempts per day?
But I would like to know if there is a similar recommendation for windows based servers. My server has RDP open to the net, and at times I've been hit with so many login requests it actually DOS'ed the machine. I've changed my port number and this helped for a while, but now I see they're back to hitting on the "new" port as well. I'm also seeing that these login attempts come from many source ip's, so it is distributed.
Is there a service or app that can see all the failed logins and temporarily ban the ip's? Like a fail2ban for win?