Logs show thousands of failed logins per hour against a remote desktop service exposed directly to the internet so a few administrators can work remotely. Which change most directly removes this attack vector?

Remote access threat vectors include remote desktop, Virtual Network Computing and virtual private networks. A remote desktop service exposed directly to the internet is continuously targeted by automated password-guessing and exploitation attempts. Placing it behind a VPN or remote access gateway that enforces multifactor authentication removes it from direct internet reach, so attackers must first defeat a stronger, centrally monitored access layer. Moving the service to a nonstandard port is security through obscurity; scanners find services on any port, and the service remains exposed to the same attacks. Enabling verbose logging is a detective measure that records attempts but does not prevent them or reduce the exposure. Disabling account lockout makes the situation worse, because it removes a control that slows password guessing against the accounts being targeted. Exam caveat: a VPN itself is also listed as a remote access vector, so it must be patched and protected with strong authentication. Operational check: verify from an external network that the remote desktop port is closed, confirm administrators can connect only through the gateway with MFA, review the logs for any successful logins during the exposure period, and reset credentials for accounts that were targeted.