Hello, we have a few servers where the security logs shows repeated brute force login attempts via RDP... shouldn't the IPS block these kind of "attacks" by default?
Meantime, if your RDP users are coming from known IP's (even if they're dynamic as most don't change all that often), you could certainly limit the IP's to specific addresses, or at least a known subnet, as the only allowed addresses. And you can keep those settings in place when you roll out the VPN's as well.
