I've been thinking about the future of EvlWatcher and would be interested in hearing the community's thoughts.
EvlWatcher was originally created to address a problem that many Windows administrators faced: protecting publicly exposed services, especially RDP, from constant brute-force attacks. At the time, a "Fail2Ban for Windows" approach filled a gap that Windows itself did not address very well.
Over the years, however, my perspective has shifted. While EvlWatcher is effective at detecting and blocking repeated authentication failures, it does not solve what I increasingly see as the real problem: exposing RDP directly to the public Internet in the first place.
A publicly reachable RDP service remains publicly reachable regardless of how quickly attackers are banned. Brute-force attacks are only one category of threat. Future protocol vulnerabilities, authentication bypasses, and other attack vectors cannot be mitigated by log-based IP blocking.
Today, the prevailing security recommendation is generally to avoid public RDP exposure altogether and instead use VPNs, Remote Desktop Gateways, Zero Trust solutions, or other controlled-access approaches.
Because of this, I've started wondering whether continuing active development of EvlWatcher still makes sense, or whether the project has largely fulfilled its purpose and should eventually transition into maintenance or archive status.
I've been thinking about the future of EvlWatcher and would be interested in hearing the community's thoughts.
EvlWatcher was originally created to address a problem that many Windows administrators faced: protecting publicly exposed services, especially RDP, from constant brute-force attacks. At the time, a "Fail2Ban for Windows" approach filled a gap that Windows itself did not address very well.
Over the years, however, my perspective has shifted. While EvlWatcher is effective at detecting and blocking repeated authentication failures, it does not solve what I increasingly see as the real problem: exposing RDP directly to the public Internet in the first place.
A publicly reachable RDP service remains publicly reachable regardless of how quickly attackers are banned. Brute-force attacks are only one category of threat. Future protocol vulnerabilities, authentication bypasses, and other attack vectors cannot be mitigated by log-based IP blocking.
Today, the prevailing security recommendation is generally to avoid public RDP exposure altogether and instead use VPNs, Remote Desktop Gateways, Zero Trust solutions, or other controlled-access approaches.
Because of this, I've started wondering whether continuing active development of EvlWatcher still makes sense, or whether the project has largely fulfilled its purpose and should eventually transition into maintenance or archive status.