asked on

Terminal server question

I have a MS server 2003 SP2 box running terminal services. I was just looking in the Terminal Server Manager and noticed that under the server name, where it lists the connected users, it keeps flashing up a connection for a second or so, and then it disappears. It looks like
the window in the attached file, except that the pic doesn't show the entry that I'm asking about. It keeps popping up a connection for "RDP-Tcp#1151" (this number keeps incrementing each time by one, and just continues counting up. Any idea what this could be? Thanks very much.
TermSrv.jpg

SOLUTION

strivoli

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

BScott52

ASKER

I'll check. Thanks for the response.

SOLUTION

kevinhsieh

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

BScott52

ASKER

I have checked the security log and found a very long list of audit failures, mostly for user administrator. And yes, this is on the standard port 3389. I found in the log that this has been going on for a couple of months. Ever heard of attempts lasting that long? I recently changed the admin password, and both the old pw and the new one are fairly complex - I don't see anyone breaking them. And I'm stuck with server 2003 for now, although we'll likely get a new server with 2008 in the next few months.

Any suggestions on how to shut them down? Change the port, etc.?

Thanks.

ASKER CERTIFIED SOLUTION

strivoli

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

strivoli

Also, limit IP (or range of) from where you can RDP to the server.

BScott52

ASKER

Thanks for all the help.