Windows Server "Account Locked Out" After Too Many Sign-In Attempts — Fix It

Step 1 — Stop the attack (portal)

Cloud instances: the VM firewall

1. Log in at amoni.app, open Virtual Machines, click the instance, then the Network tab and scroll to Firewall.
2. If the firewall is off, click Enable firewall. From that moment every inbound connection not matched by an allow rule is dropped, RDP included. An SSH allow rule is added automatically so you cannot lock yourself out of a Linux session; for Windows that rule is harmless.
3. If the firewall is already on and there is an allow rule for port 3389 without a source, remove it with the × on its row.
4. Either way, add the rule you will want later: Add Rule → Direction Inbound, Action Allow, Protocol TCP, Port 3389, Source your own public address or network (for example 198.51.100.0/24), a comment, then Add Rule. RDP now answers your network only; the bots hit a closed port.

Bare-metal servers: a FlowSpec rule at the network edge

A bare-metal server has no firewall in front of it by default, but you can drop specific traffic at our edge routers before it reaches the machine:

1. Open Network Security in the left-hand menu and, under FlowSpec Rules, click New Rule.
2. Destination IP: the server's address. Action: Discard (drop). Protocol: TCP. Dest port: 3389. Leave Source prefix empty to drop RDP from everywhere.
3. Auto-withdraw after: pick a window long enough to sit out the lockout and do the hardening below, up to 24 hours. The rule removes itself when it runs out; you can also withdraw it by hand.
4. Click Create Rule. It is active on the edge within a minute.

Because FlowSpec rules are temporary, they buy you time; the permanent fix for bare metal is in Step 4.

Step 1 — Stop the attack (API)

Cloud instances: the VM firewall is fully available in the API with the VMs scope (vms.write). Reference: api.amoni.app/v1/docs.

Turn the firewall on (blocks all unmatched inbound at once; an SSH allow is seeded):

curl -s -X PUT https://api.amoni.app/v1/vms/990204/411/firewall/enable \
  -H "Authorization: Bearer nr_live_..." \
  -H "Content-Type: application/json" \
  -d '{"enabled": true}'

See the rules and remove any open RDP allow by its position:

curl -s https://api.amoni.app/v1/vms/990204/411/firewall -H "Authorization: Bearer nr_live_..."

{ "success": true, "data": { "enabled": true, "rules": [
  { "pos": 0, "direction": "in", "action": "ACCEPT", "proto": "tcp", "port": "22", "source": null, "comment": "SSH", "enabled": true },
  { "pos": 1, "direction": "in", "action": "ACCEPT", "proto": "tcp", "port": "3389", "source": null, "comment": "RDP", "enabled": true } ] } }

curl -s -X DELETE https://api.amoni.app/v1/vms/990204/411/firewall/1 -H "Authorization: Bearer nr_live_..."

Allow RDP from your network only:

curl -s -X POST https://api.amoni.app/v1/vms/990204/411/firewall \
  -H "Authorization: Bearer nr_live_..." \
  -H "Content-Type: application/json" \
  -d '{"direction": "in", "action": "ACCEPT", "proto": "tcp", "port": "3389", "source": "198.51.100.0/24", "comment": "RDP from the office only"}'

action is ACCEPT, DROP or REJECT; proto is tcp, udp, icmp or omitted for any; port takes a single port, a range (8000:8100) or a comma-separated list. New rules are appended after the existing ones. A wrong value answers 422 in the framework shape ({"message": "The selected action is invalid.", "errors": {…}}); when the hypervisor cannot be reached the calls answer 500 with “Firewall state is unavailable right now. Please retry.” or “The rule could not be added. Please retry.”

Bare metal: FlowSpec rules are created in the portal for now. The API's /v1/blackhole endpoint exists for a different situation, a volumetric attack where the whole address must go dark; it drops all traffic to the address, so it is not the tool for an RDP brute-force.