Windows Server Brute-Force Protection
Lock down your Windows server like a real fortress.
LockWall is a Windows service that protects your servers from brute-force attacks against remote access services. It monitors the Windows Event Log in real-time, detects failed login attempts, and automatically blocks attacking IPs via Windows Firewall.
- 🖥️ RDP (Remote Desktop Protocol) — Event ID 4625 in the Security Log
- 📧 OWA (Outlook Web Access) — IIS-hosted authentication via w3wp.exe
- 🗄️ SQL Server — Event ID 18456 in the Application Log
- 🔑 SSH (Windows OpenSSH Server) — Event ID 4 in the OpenSSH/Operational log
RDP brute-force is one of the most common attacks on internet-facing Windows servers. A public-facing machine can receive thousands of automated login attempts a day. LockWall blocks attackers before they crack passwords — automatically, with progressive escalation, and with notifications.
Free forever — all four protocols, every feature, no license key, no seat limits.
- 🔍 RDP / OWA / SQL / SSH brute-force monitoring — four protocols, one service
- 🎯 Password Spray Detection — blocks IPs trying multiple usernames
- 📈 Progressive Blocking — escalating duration for repeat offenders (1h → 24h → 7d → permanent)
- ⚙️ Per-source Policies — separate thresholds for RDP, OWA, SQL
- ✅ Whitelist with CIDR support (block subnets, never block trusted networks)
- 🌍 GeoIP — optional country/city/ISP lookup for attacking IPs (multiple providers; off by default)
- 📊 Dashboard — real-time statistics and top attackers
- 🚫 Blocked IPs — manage blocks (manual block/unblock, change duration)
- 📈 Analytics — graphs of hourly attempts, daily activity, top countries
- 📋 Logs viewer — live updates, filters, search
- ⚙️ Settings — edit config via the UI, no YAML editing required
- 🩺 Health page — system diagnostics (DB, firewall, notifications, disk, service)
- 📑 Audit Log — track all admin actions
- 👥 User Management — multi-admin with RBAC (Admin / Viewer roles)
- 🔔 Notifications — Telegram + Email on every block, with GeoIP enrichment
- 📤 CSV Export — Blocked IPs, Audit Log, Login Attempts
- 🔑 API Tokens — Bearer / X-API-Key auth for the current JSON endpoints (and the future versioned public API)
- 🪟 Native Windows Service — lightweight, runs entirely on your server
- 🔥 Smart Firewall Rules — grouped by duration category (not one rule per IP)
- ☁️ Self-hosted — no cloud backend, no external agents; your data stays on your server
- 🔒 Authentication — login, RBAC, session timeout, forced password change
- Download
LockWall-Setup-x64.msi(~14.4 MB) - Run the installer (accept the license) — it installs to
C:\LockWalland registers + starts the Windows service automatically - Open the web UI: http://127.0.0.1:8880/
- Login:
admin/lockwall(you'll be forced to change the password)
That's it — LockWall is now watching your Event Log and blocking attackers.
Before exposing the server, add your trusted networks to the whitelist
(Settings → Whitelist in the web UI, or C:\LockWall\config\config.yaml):
whitelist:
- 127.0.0.1
- "::1"
- 192.168.1.0/24 # Your local network
- 10.0.0.0/8 # VPN
- 203.0.113.5 # Your public IPThis prevents you from ever locking yourself out.
LockWall installs as a standard Windows service. Manage it from an elevated prompt:
lockwall.exe status # Check status
lockwall.exe stop # Stop
lockwall.exe start # Start
lockwall.exe restart # Restart
lockwall.exe test-notify # Send a test Telegram/Email notification
# View active firewall rules
netsh advfirewall firewall show rule name=all | findstr LOCKWALL_BLOCKTo uninstall, use Add/Remove Programs (or re-run the MSI).
Everything is editable in Settings in the web UI — no YAML required. Key options:
detection:
max_attempts: 5 # Failed attempts before block
time_window_minutes: 10 # Counting window
block_duration_minutes: 10080 # 7 days (0 = permanent)
progressive_blocking:
enabled: true
levels: [60, 1440, 10080, 0] # 1h → 24h → 7d → permanent
spray_detection:
enabled: true
unique_usernames: 3 # 3+ usernames = spray attack
owa_protection: { enabled: false } # Enable on OWA servers
sql_protection: { enabled: false } # Enable on SQL Server hosts
ssh_protection: { enabled: false } # Enable on hosts with OpenSSH Server
web:
host: 127.0.0.1 # Don't expose externally without HTTPS!
port: 8880Full reference: docs/USER_GUIDE.md.
⚠️ Download LockWall only from lockwall.app or this repository's GitHub Releases. Do not install repackaged copies from third-party mirrors or software catalogs.
LockWall is closed-source freeware. To let you trust a binary you can't read, every release is verifiable:
- ✅ SHA-256 checksum published with each release — verify your download matches
- ✅ VirusTotal scan linked in every release's notes
- ✅ Open issue tracker — bugs and questions in the public Issues
# Verify your download (compare against the SHA-256 in the release notes)
Get-FileHash .\LockWall-Setup-x64.msi -Algorithm SHA256Found a vulnerability? See SECURITY.md — please disclose responsibly.
| File | Audience | Language |
|---|---|---|
| USER_GUIDE.md | End users / administrators | English |
| PHILOSOPHY.md | Why LockWall is free | English |
- ✅ Change the default password immediately (forced on first login)
- ✅ Whitelist your trusted networks before exposing the service
- ✅ Keep
host: 127.0.0.1unless you put an HTTPS reverse proxy in front - ✅ Back up
config.yamlanddata\lockwall.dbregularly
LockWall is free and stays free — no paid tier, no locked features, no license keys. The roadmap is simply about making the free product better:
- 🔏 Code signing — signed binaries so Windows stops warning "Unknown Publisher"
- 🔌 Versioned REST API — stable
/api/v1/…endpoints for automation and SIEM - 📡 Webhooks — push block events to external systems
- 🌍 More notification channels beyond Telegram / Email
Have an idea or hit a bug? Open an issue — feature requests and reports are welcome.
- OS: Windows 10 / Server 2016 (or newer), 64-bit
- RAM: 256 MB (512 recommended)
- Disk: 100 MB (500 MB for logs)
- Privileges: Administrator (for Windows Firewall + audit policy)
- Audit Policy: Logon Failure auditing (LockWall enables it automatically)
LockWall is proprietary freeware — free to use for personal and internal commercial purposes, but not open source. Modification, reverse-engineering, resale, rebranding, and public redistribution (re-hosting or mirroring the installer) are not permitted — please download only from the official sources. See LICENSE (EULA) for the full terms.
© 2026 Serhii Smoktii. All rights reserved.
- Website: lockwall.app
- Download: GitHub Releases
- Issues: github.com/SMSerg2000/LockWall/issues
LockWall — Lock down your Windows server like a real fortress. 🛡️