windowslock (licensed edition)

For 64-bit Windows Server 2016, 2019, 2022, and 2025. It runs inside Windows and does not call any one cloud vendor's API. Alibaba Cloud, Tencent Cloud, Amazon Web Services, Microsoft Azure, Huawei Cloud, and other hosts are all fine.

Website and purchase
- Site and downloads: https://windowslock.com
- Buy a license (USDT, monthly or yearly): https://windowslock.com/buy
- Admin site: https://htt666.windowslock.com

License
- Buy a license key before you install. Monthly and yearly plans are paid in USDT (TRC20 by default).
- Activation binds the key to this machine. The app reminds you 7, 3, and 1 days before expiry. If Telegram is enabled, it also tries to send that reminder.
- After expiry there is a short grace period. Renew at the website as soon as you can.

What it does
Once the Remote Desktop port is found, a guessed password is enough to sign in. After setup, sign-in needs the account password and a 6-digit code from an authenticator. Google Authenticator, Microsoft Authenticator, and Authy all work.

It also:
- Keeps Remote Desktop on an encrypted connection and asks for the code on the sign-in screen
- Stops cloud agents that run remote commands or change the password online
- Turns off WinRM and blocks ports such as 135, 139, and 445 that can be entered with a password only
- Encrypts the system disk when a TPM is available. A disk moved to another machine cannot be read, and this sign-in check cannot be deleted from it
- Leaves the old password sign-in in place for 20 minutes so you can test. Turn it off after the test works
- Optionally sends a Telegram message after a successful sign-in. Leave the token and admin ID empty to skip that

What it cannot do
If the virtual machine is still running, the cloud operator can in theory read memory from below the guest. That is a limit of virtualization, not something a one-time code can stop. The usual console sign-in, online password change, and rescue-disk paths are blocked. What remains is usually a reinstall, which erases the data on this machine.

How to install
1. Buy a license at https://windowslock.com/buy, pay USDT, submit the transaction hash, and wait for the license key.
2. Copy the windowslock folder to the server. It must contain 1. Trust windowslock.exe, windowslock.exe, windowslock.dll, QrCodeGenerator.dll, and README.txt.
3. Double-click 1. Trust windowslock.exe and click Allow. Approve the administrator prompt. Wait until it says the certificate is installed.
4. Double-click windowslock.exe. Do not close the current remote session.
5. Paste the license key on the first page and click Activate. Continue only after it succeeds.
6. Scan the QR code, or enter the key by hand. The account name is windowslock and the type is time-based. Write down the 8 backup codes somewhere else. Each code works only once.
7. Enter the current 6-digit code from your phone. This only checks that the clock and the key match. That code cannot be used to sign in afterward.
8. Review the options. Telegram is at the bottom of that page:
   - For sign-in and expiry alerts, fill in both boxes. Copy the bot token from BotFather. The admin ID is a number; send a message to @userinfobot in Telegram to see it. Open your bot in a private chat and tap Start once, or it cannot message you.
   - To skip alerts, leave both boxes empty.
   Then click Start protecting this server.
9. Open a second Remote Desktop session. On the sign-in screen choose windowslock, enter the Windows password, then a new 6-digit code.
10. When that works, return to the first window and click Turn off old sign-in. You can also use Turn off the old sign-in on the progress page, or Close to exit.

The disk recovery key is shown only once, on the last page. Copy it and do not store it on this server. Without that key, nobody can unlock the encrypted disk, including you.

The system clock must be accurate. The codes are based on time. Do not turn off time sync.

Telegram sign-in alerts
The setup page has two boxes: bot token and admin numeric ID.
- Both filled in: about half a minute after a sign-in or unlock, a message is sent. It contains the computer name, account, whether it was a sign-in or an unlock, the source address, and the time. The password and the code are not sent. An expiry reminder is also attempted.
- Both empty: no sign-in alerts are sent.
- Only one filled in: alerts stay off.
A failed send does not block sign-in.

After setup, open the windowslock shortcut on the desktop and enter the current code:
- Replace token: enter the code and the new token, then click Replace token
- Add admin: enter the code and the admin ID, then click Add admin
- Remove admin: enter the code and the admin ID, then click Remove admin
- Renew: paste the new license key on the maintenance page and click Activate / renew
If the code is wrong, none of the Telegram changes are saved.

The bot only sends sign-in messages and expiry reminders. This program does not read messages sent to the bot and does not act on them. Someone who obtains the token still cannot control this server with it.

Lost authenticator
If you still have a backup code, type it in the code box, for example ABCDE-23456. A used backup code is discarded.
If the backup codes are gone but you saved the disk recovery key, reinstall, or use the recovery key in the cloud vendor's rescue environment to unlock the disk and delete the registry value below. The old password sign-in comes back only after that value is removed.
If the disk was not encrypted and you have no recovery key, mount the system disk on another machine and delete the same registry value to return to password sign-in. On a machine without a TPM, someone who can remove the disk can still remove this program. The sign-in code still works while the program is installed.

Uninstall
Open windowslock, enter the current code, and click Uninstall. Cloud agents and the previous Remote Desktop sign-in are restored. Disk encryption is left on.

Rebuild (developers)
On Windows with Visual Studio Build Tools installed, run this in the source directory:
powershell -ExecutionPolicy Bypass -File build.ps1
The output is the windowslock\windowslock\ folder.

QR codes use Net.Codecrete.QrCodeGenerator 2.0.7, MIT license, by Manuel Bleichenbacher and Project Nayuki.
