I would like to ban IP addresses after incorrect (RDP right now, soon to be VPN once I get that going) login attempts on a Windows Server 2008 R2 machine I help administer.
This answer specifically talks about ssh, which I'm not running.
This answer mentions terminal services and remote desktop.
No one specifically mentions VPN.
Will both of these apply to VPN? I'm a little bit uncertain about how Windows handles these different failed logins. It looks like these will be Logon Type: 10 (RDP) and Logon Type: 3 (VPN + terminal services...?) From what I understand about these tools is that they will have to parse the Windows Event Log to grab the incorrect logins, and then modify the Firewall rules.
I would like to try WinFail2Ban because I've used it in Linux before. Administering Linux (just SSH!) is WAY easier. Does anyone have experience with this? Will it work? I found ZERO questions with WinFail2Ban on serverfault.
Thank you very much for the help. I will simply start trying things, likely starting with WinFail2Ban. Since I am very new at Windows Server 2008, I wanted to post a question here first.