Solved

securing the TS web access server 2008 agains the attacks

Posted on 2011-09-16
5
394 Views
Last Modified: 2012-05-12
Hi
Almost every day I check 100's of unsuccessful logon attempts on my terminal server. TS Web access on server 2008 ent edition.  Though I am using https/ssl certificate to encrypt my communications.  My clients access this ts web access via 'https:/server.domainname.com'
How can I set up my configurations so that any one trying to establish connection via 'brute force, tsgrinder, etc etc which use dictionary attacks of various combinations should be disconnected after a couple of tries.  I have also made unsuccessful logon attemps to 3 on this pariticular ts server local policy but still, attackers can establish and remain establish with this server.   THere must be a way where anyone using these malicious programs should be disconnected automatically after a couple of attempts.  How and where.  I am trying to make this terminal server fully secured.  Possible?  Domain/enterprise admins have to waste alot of time to overcome security issues when easy articles like:
http://www.ethicalhacker.net/content/view/106/24/
are available.
Help plz
0
Comment
Question by:amanzoor
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 2
5 Comments
 
LVL 6

Accepted Solution

by:
rpassero earned 500 total points
ID: 36549316
The most effective way to accomplish this is with a third-party firewall/IPS in front of the server. If you have a limited budget something like a Cisco SA500-series with the IPS module would do the trick.
0
 
LVL 4

Author Comment

by:amanzoor
ID: 36550708
rpassero:
I have a firewall router cisco 2911, and its only forwarding ports 443 and 3389.  I am using access-list 101.  Is there anything more I can do with it? Help
0
 
LVL 6

Expert Comment

by:rpassero
ID: 36550870
As an aside, the account lockout policies configured in Active Directory need to be applied to user accounts and not to the OU holding the TS servers.

I always recommend licensing the security technology package on an ISR -- it greatly expands the device's capabilites as a firewall and intrusion prevention device, which is really what you're looking for here. Once you have that licensed you're going to want to configure things like stateful packet inspection and NetFlow.
0
 
LVL 4

Author Comment

by:amanzoor
ID: 36551246
Here is where I am applying the policy (please see the image)
I have the license for Netflow (it only shows me the packets).  May be to controll as you suggested I need security technology package on an ISR.  
Well I think I should look for a solution via things which I alredy have.  Please suggest if my policy is correctly applied.  I have applied it on a GPO on a terminal server OU.  RIght?
New-Picture--2-.bmp
0
 
LVL 6

Expert Comment

by:rpassero
ID: 36557222
If your Active Directory functional level is Server 2008, you can use what's call "fine-grained password and lockout policies," which can be applied to security groups; if it's anything prior to 2008 then the only password policy that matters what's defined in the default policy. Fine-grained password policies are applied to users and global security groups, not to OUs.

For information about how this works take a look at http://technet.microsoft.com/en-us/library/cc770842%28WS.10%29.aspx 
0

Featured Post

Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Trojan 28 116
PEN and Issuance policy for 2 tier Windows 2012 PKI 3 82
Wordpress contact form sending spam 2 50
security, windows patches update 22 42
This article describes my battle tested process for setting up delegation. I use this process anywhere that I need to setup delegation. In the article I will show how it applies to Active Directory
I was prompted to write this article after the recent World-Wide Ransomware outbreak. For years now, System Administrators around the world have used the excuse of "Waiting a Bit" before applying Security Patch Updates. This type of reasoning to me …
This tutorial will walk an individual through the steps necessary to enable the VMware\Hyper-V licensed feature of Backup Exec 2012. In addition, how to add a VMware server and configure a backup job. The first step is to acquire the necessary licen…
Email security requires an ever evolving service that stays up to date with counter-evolving threats. The Email Laundry perform Research and Development to ensure their email security service evolves faster than cyber criminals. We apply our Threat…

739 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question