# fail2ban for Windows: what to use instead

> Is there fail2ban for Windows? Why it won't run on Windows Server, what WSL2 can't do, and how IPBan, RdpGuard and lockout policies stop RDP brute force.
>
> Source: https://fail2ban.dev/alternatives/windows/ · Updated 2026-10-25 · Checked against fail2ban 1.1.1
> fail2ban.dev is an independent guide, not the official fail2ban project.

**There is no native fail2ban for Windows.** fail2ban is written for Linux and BSD: it reads text log files and bans through tools like nftables, iptables or pf, while Windows records failed logons in the Event Log and filters traffic with Windows Defender Firewall. The closest equivalent is **IPBan**, a free, MIT-licensed service that watches failed RDP, SSH, SQL Server and other logins and blocks the source IPs in Windows Firewall. For RDP, the stronger fix is not exposing port 3389 to the internet at all.

## Why fail2ban doesn't run on Windows

fail2ban is built around three Unix assumptions:

1. **Logs are text files or the systemd journal.** Windows records a failed logon as event ID 4625 in the Security event log — a binary store that fail2ban has no backend for.
2. **Bans are shell commands for a Unix firewall.** Every action in `action.d` calls `nft`, `iptables`, `firewall-cmd`, `pfctl` or similar tools. None exist on Windows.
3. **It runs as a Unix daemon** with a Unix domain socket between `fail2ban-client` and `fail2ban-server`.

The fail2ban source itself marks Windows as not currently supported, and there is no official Windows build. The "fail2ban for Windows" downloads you'll find are different projects that borrow the name or the idea. See [how fail2ban works](/how-it-works/) for the full architecture.

## Can you run fail2ban in WSL2?

You can install fail2ban in a WSL2 distribution (`sudo apt install fail2ban` in Ubuntu on WSL), but it protects only what runs **inside** that Linux VM:

| Works in WSL2 | Doesn't work |
|---|---|
| Banning attackers of an SSH or web server running inside WSL2 | Protecting RDP, SMB, IIS, SQL Server or any Windows service |
| Reading log files written inside the WSL2 distribution | Reading the Windows Security event log |
| nftables/iptables rules inside the WSL2 VM | Adding rules to Windows Defender Firewall |

The WSL2 firewall only filters traffic going *into* the WSL2 VM. Even in mirrored networking mode, connections to Windows services never pass through it. WSL distributions also aren't designed to run as always-on services and can be stopped when idle.

You could write a custom action that calls `powershell.exe` through WSL interop to add Windows firewall rules, but that needs an elevated session and an exported copy of the event log — fragile, and not something to rely on for a public-facing server. Docker Desktop has the same limitation; [fail2ban in Docker](/guides/docker/) assumes a Linux host. If you want the real thing, run fail2ban on a proper Linux VM or reverse proxy that fronts the service. For anything on the Windows side, use a Windows-native tool.

## Windows alternatives to fail2ban

These tools do what fail2ban does — watch for failed logins, block the source IP in the firewall — using Windows' own event log and firewall:

| Tool | Type | What it watches | How it blocks | License / price | Status (Oct 2026) |
|---|---|---|---|---|---|
| **IPBan** (DigitalRuby) | Service, Windows and Linux | Event Log: RDP, OpenSSH, VNC, MySQL, SQL Server, Exchange, SmarterMail, MailEnable; custom logs via config | Windows Firewall rules | MIT; paid **IPBan Pro** adds central management | Active, 4.1.0 (Jun 2026) |
| **EvlWatcher** | Service + GUI | Event Log failed logons (RDP) | Adds IPs to one Windows Firewall rule | MIT, free | Discontinued; archived Sep 2026 |
| **RdpGuard** (Netsdk Software) | Commercial service | RDP, RD Web Access, MS-SQL, MySQL, IIS logins, FTP, SMTP/IMAP/POP3, VoIP/SIP, OpenSSH, RRAS VPN | Windows Firewall | Paid licence, 30-day trial | Active, 10.4.5 (Oct 2026) |
| **wail2ban** | PowerShell script | Event ID 4625, SQL Server 18456 | `netsh` firewall rules | BSD-3-Clause | Archived in 2020 — don't use |
| **CrowdSec** | Agent + Windows Firewall bouncer | Event Log and log files, IIS | Windows Firewall | MIT engine | Active |
| **Wazuh** active response | SIEM agent | Event Log via Wazuh rules | `netsh.exe` script | GPL-2.0 | Active |
| **Account lockout policy** | Built into Windows | Failed logons per *account* | Locks the account, not the IP | Free | Built in |
| **IIS Dynamic IP Restrictions** | Built into IIS 8+ | Concurrent or rapid HTTP requests per IP | Denies requests from that IP | Free | Built in |

## IPBan: the closest thing to fail2ban for Windows

IPBan runs as a Windows service, subscribes to the Event Log and counts failed logons per IP. When an address crosses the threshold in `ipban.config` (the same file sets ban duration, whitelists and extra log sources), it adds the address to Windows Firewall rules created by IPBan, and removes it when the ban expires. It supports Windows 10 or newer and Windows Server 2016 or newer; Windows Server 2025 needs IPBan 2.0.1 or later. The free edition is open source on GitHub; **IPBan Pro** is a paid subscription with central management for many servers — check ipban.com for current pricing.

The project's README installs the latest release from an elevated PowerShell prompt:

```powershell
```

How it maps to fail2ban concepts: `ipban.config` ≈ `jail.local`; the failed-login threshold and window ≈ `maxretry` and `findtime`; ban time ≈ `bantime`; whitelist ≈ `ignoreip`. IPBan also runs on Linux, but there fail2ban has far more filters, so IPBan is mainly interesting for mixed Windows/Linux fleets that want one tool.

## EvlWatcher, RdpGuard and wail2ban

**EvlWatcher** was a small free tool aimed squarely at RDP: a service scanned the Security log for failed logons and added offending IPs to a single Windows Firewall rule, with a GUI to manage bans. It worked with almost no configuration — a two-hour ban after repeated failures and a permanent list for repeat offenders. Its author **discontinued it and archived the repository in September 2026** (last release v2.1.62). Existing installs keep working, but plan a move to IPBan or another maintained tool rather than deploying it on new servers.

**RdpGuard** is commercial software with a long list of supported services — useful on Windows hosting servers that run IIS, SQL Server, mail and FTP side by side and want a GUI and vendor support.

**wail2ban** was an early PowerShell port of the fail2ban idea. It's useful to read, but don't deploy an unmaintained script on a production server.

## Stop RDP brute force on Windows Server

Banning tools reduce noise; these steps remove most of the attack surface and matter more than any ban tool:


1. **Don't expose RDP (TCP/UDP 3389) to the internet.** Put it behind a VPN such as WireGuard (see the [WireGuard guide](/guides/wireguard/) for protecting the VPN endpoint itself), OpenVPN or your firewall's VPN, or behind Remote Desktop Gateway with multi-factor authentication.
2. **If it must be public, restrict the source.** Limit the built-in Remote Desktop firewall rules to your office or admin IP ranges (example below).
3. **Keep Network Level Authentication on**, so clients must authenticate before a full session is created.
4. **Use strong, unique passwords**, rename or disable unused local accounts, and set an [account lockout policy](#windows-account-lockout-policy).
5. **Add IPBan or a similar tool** to drop the addresses that still get through.

Restrict the Remote Desktop rules to known addresses:

```powershell
```

```powershell
```

```powershell
```

## Windows account lockout policy

Windows can lock an *account* after repeated failed passwords. Open `secpol.msc` (or Group Policy) → Account Policies → Account Lockout Policy, or set it from an elevated prompt:

```powershell
net accounts
```

Lockout is not a substitute for IP banning. It slows guessing against one account, but the attacker keeps trying other usernames, keeps consuming resources, and can deliberately lock out your real users. Use it alongside an IP-banning tool, not instead of one.

## Linux servers next to Windows

Many teams run Windows for RDP and Linux for everything public-facing. On the Linux side, fail2ban is the standard tool: [install it](/install/) and enable the [SSH jail](/guides/ssh/) in a few minutes. If the "Windows RDP" you're protecting is actually xrdp on a Linux box, fail2ban handles it natively with the upstream `xrdp` filter (see the [filter list](/filters/)) and an `[xrdp]` jail.

Ban data isn't shared between fail2ban and Windows tools out of the box. If you need one shared block list across both platforms, use IPBan on both, or a tool with agents for both, such as CrowdSec ([fail2ban vs CrowdSec](/alternatives/crowdsec/)).

## FAQ

### Is there a fail2ban for Windows?

No. fail2ban only runs on Linux, BSD, macOS and other Unix-like systems, because it reads text logs and calls Unix firewall tools. On Windows, IPBan is the closest equivalent: it reads failed logons from the Event Log and blocks IPs in Windows Defender Firewall. RdpGuard is a commercial option; EvlWatcher was discontinued in September 2026.

### What is the fail2ban equivalent for Windows Server 2022 and 2025?

IPBan by DigitalRuby, a free MIT-licensed service. It supports Windows Server 2016 and newer, including 2022 and, from version 2.0.1, Server 2025. Install it as a service, adjust thresholds in `ipban.config`, and it blocks IPs with repeated failed RDP, SQL Server or other logons in Windows Firewall.

### How do I stop RDP brute-force attacks on Windows?

Best: don't expose RDP to the internet — use a VPN or Remote Desktop Gateway with MFA. If RDP must be reachable, limit the firewall rule to known IPs, keep Network Level Authentication on, set an account lockout policy, and run an IP-banning tool such as IPBan to block repeat offenders.

### Can I run fail2ban in WSL2 on Windows 10 or 11?

You can install it, but it only bans traffic to services running inside the WSL2 Linux distribution. It can't read the Windows Event Log, and its firewall rules don't affect Windows services such as RDP, SMB, IIS or SQL Server. For those, use a Windows-native tool like IPBan.

### Is IPBan free?

Yes. The core IPBan project is open source under the MIT license and free to use on Windows and Linux. IPBan Pro is a paid subscription from the same developer that adds central management of many servers; see ipban.com for current pricing.

### Does Windows account lockout replace fail2ban?

No. Account lockout locks a user account after repeated wrong passwords, but it doesn't block the attacker's IP. The attacker can keep guessing other usernames and can lock out legitimate users on purpose. Use lockout together with an IP-banning tool and restricted RDP access.