Forwarding RDP, what is the risk?

Question

Information Security

Let's say an attacker scanned ports and found that he could get to a Windows machine via RDP. It throws out username/password. What can he do about it?

Answer 1

Enable blunt enumeration of all possible logins and block all accounts (N incorrect entries).
If everything is bad with security, it may puzzle you with brute force.