Implementing MFA (multi-factor authentication) and limiting failed log-in requests are two effective ways to prevent brute-force attacks on an OS. MFA requires users to provide more than one piece of evidence to prove their identity, such as a password and a code sent to their phone. This makes it harder for attackers to guess the correct credentials. Limiting failed log-in requests prevents attackers from trying too many password combinations in a short time, by locking out the account or the IP address after a certain number of attempts.
This slows down the attack and alerts the administrator of a possible intrusion. References: How To Prevent Brute Force Attacks With 8 Easy Tactics, Blocking Brute Force Attacks