nickBAN 1.0 - auto ban IP addresses with failed logins (portable, no install)
Runs on Windows Server 2012 R2 / 2016 / 2019 / 2022 / 2025 and Windows 8.1 / 10 / 11 (64-bit).
==========================================================================

FILES (keep them together in one folder, e.g. C:\nickBAN\)
  nickBAN.exe          the program
  nickBAN.ini          settings (re-created with defaults if deleted)
  nickBAN_state.json   created automatically: current bans + read positions
  nickBAN.log          created automatically: activity log

QUICK START
  1. Copy the folder anywhere, e.g. C:\nickBAN
  2. Edit nickBAN.ini (whitelist your own IPs first!)
  3. Double-click nickBAN.exe (it asks for Administrator rights).
     A console window shows failed logins and bans live.
  4. To run it hidden at every boot instead, open an admin command prompt:
        C:\nickBAN\nickBAN.exe -installtask

HOW IT WORKS
  - Every CheckIntervalSeconds it reads new Event Viewer entries (default:
    Security 4625, RDP 140, MS SQL 18456, OpenSSH) and the text logs listed
    under [LogFiles].
  - An IP with FailedLoginThreshold failures within FailedLoginWindowMinutes
    is banned for BanDays (default 10 days). Expired bans are removed
    automatically - the list recycles itself.
  - Every FirewallUpdateIntervalSeconds, if anything changed, it rewrites the
    Windows Firewall inbound block rule "nickBAN" (split into several rules
    with the same name when the list is long). Blacklist entries are always in it.
  - Whitelisted IPs are never banned. Settings are reloaded automatically.

COMMANDS (admin command prompt)
  nickBAN.exe -list               show bans
  nickBAN.exe -ban 1.2.3.4        manual ban
  nickBAN.exe -unban 1.2.3.4      unban (wildcards ok: -unban 80.16.*.*)
  nickBAN.exe -clear              unban all (blacklist stays)
  nickBAN.exe -once               one check, then exit
  nickBAN.exe -removefirewall     delete the firewall rule(s)
  nickBAN.exe -installtask / -removetask
  These also work while nickBAN is already running.

IMPORTANT
  - Windows only logs failed logons if auditing is on. If Security 4625 never
    shows up, run in an admin prompt:
      auditpol /set /category:"Logon/Logoff" /failure:enable
  - The Windows Firewall must be enabled for the block rule to have effect.
  - The whitelist stops IPs from being banned, but does not punch holes in a
    blacklist RANGE. Don't blacklist a range that contains your own IP.
