Avatar of BScott52
BScott52
 asked on

Terminal server question

I have a MS server 2003 SP2 box running terminal services. I was just looking in the Terminal Server Manager and noticed that under the server name, where it lists the connected users, it keeps flashing up a connection for a second or so, and then it disappears. It looks like
the window in the attached file, except that the pic doesn't show the entry that I'm asking about. It keeps popping up a connection for "RDP-Tcp#1151" (this number keeps incrementing each time by one, and just continues counting up. Any idea what this could be? Thanks very much.
TermSrv.jpg
Windows Server 2003

Avatar of undefined
Last Comment
BScott52

8/22/2022 - Mon
SOLUTION
strivoli

Log in or sign up to see answer
Become an EE member today7-DAY FREE TRIAL
Members can start a 7-Day Free trial then enjoy unlimited access to the platform
Sign up - Free for 7 days
or
Learn why we charge membership fees
We get it - no one likes a content blocker. Take one extra minute and find out why we block content.
Not exactly the question you had in mind?
Sign up for an EE membership and get your own personalized solution. With an EE membership, you can ask unlimited troubleshooting, research, or opinion questions.
ask a question
BScott52

ASKER
I'll check. Thanks for the response.
SOLUTION
kevinhsieh

Log in or sign up to see answer
Become an EE member today7-DAY FREE TRIAL
Members can start a 7-Day Free trial then enjoy unlimited access to the platform
Sign up - Free for 7 days
or
Learn why we charge membership fees
We get it - no one likes a content blocker. Take one extra minute and find out why we block content.
Not exactly the question you had in mind?
Sign up for an EE membership and get your own personalized solution. With an EE membership, you can ask unlimited troubleshooting, research, or opinion questions.
ask a question
BScott52

ASKER
I have checked the security log and found a very long list of audit failures, mostly for user administrator. And yes, this is on the standard port 3389. I found in the log that this has been going on for a couple of months. Ever heard of attempts lasting that long? I recently changed the admin password, and both the old pw and the new one are fairly complex - I don't see anyone breaking them. And I'm stuck with server 2003 for now, although we'll likely get a new server with 2008 in the next few months.

Any suggestions on how to shut them down?  Change the port, etc.?


Thanks.
ASKER CERTIFIED SOLUTION
Log in to continue reading
Log In
Sign up - Free for 7 days
Get an unlimited membership to EE for less than $4 a week.
Unlimited question asking, solutions, articles and more.
strivoli

Also, limit IP (or range of) from where you can RDP to the server.
I started with Experts Exchange in 2004 and it's been a mainstay of my professional computing life since. It helped me launch a career as a programmer / Oracle data analyst
William Peck
BScott52

ASKER
Thanks for all the help.