What are the means against terminal brute force?

Question

Passwords

There is a Windows Server 2012 in the role of a terminal server, to which users can connect from the outside via RDP.
What is the remedy for brute-force passwords for domain accounts? Are there any programs that can detect brute force and block suspicious connections to the terminal?
In the events (Windows Logs -> Security) of the authorization audit, I noticed continuous attempts to guess passwords for domain account logins. Each failure event is marked as "Audit Failure" and there are many.
Moreover, each time a different "Account Name".
Advise, please, a remedy against enumeration of passwords to domain accounts via RDP. Thanks

Answer 1

It's best practice not to expose the bare rdp to the outside. It is better to organize vpn and allow connection from there.

Answer 2

As written above - RDP accessible from the outside is bad. But if there is nowhere to go, then change the standard port (3389) on the external interface to another one and just forward. Also, do not use standard accounts such as Administrator, admin, root, and set the number of failed login attempts in group policy.

Answer 3

Of all that I tried, the most adequate turned out to be RdpGuard . True paid.