Solved

Windows Terminal Server brute-force attempts

Posted on 2013-01-18
3
529 Views
Last Modified: 2013-02-15
Somebody is constantly running automated brute-force attacks against a Windows Server 2003 Terminal Server I published on WAN.
It is joined to a domain and I have Account Lockout Threshold GPO defined to lockout an account after 3 login attempts.
I also use local accounts on this server and I also set up local GPO Account Lockout Threshold to 3 login attempts.

But I still see regular logs in Event Viewer for numerous failed login attempts for non-existing domain and local users. These seem to be common usernames like admin, root, scan, etc.

What could I do to block all these attempts alltogether?
0
Comment
Question by:proteus-IV
  • 2
3 Comments
 
LVL 10

Assisted Solution

by:rscottvan
rscottvan earned 500 total points
ID: 38795291
If this server does not to be accessible from the whole internet, you can use Windows firewall, or preferably a hardware firewall, to restrict the systems that can attempt access.

You can also move RDP a less well-known port.  http://support.microsoft.com/kb/306759.
0
 

Accepted Solution

by:
proteus-IV earned 0 total points
ID: 38875180
I will upgrade the OS to Windows 2008 and implement certificate based authentication.
0
 

Author Closing Comment

by:proteus-IV
ID: 38892648
Incomplete solution.
0

Featured Post

Is Your Active Directory as Secure as You Think?

More than 75% of all records are compromised because of the loss or theft of a privileged credential. Experts have been exploring Active Directory infrastructure to identify key threats and establish best practices for keeping data safe. Attend this month’s webinar to learn more.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

A quick step-by-step overview of installing and configuring Carbonite Server Backup.
Disabling the Directory Sync Service Account in Office 365 will stop directory synchronization from working.
This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…
This tutorial will walk an individual through the process of configuring their Windows Server 2012 domain controller to synchronize its time with a trusted, external resource. Use Google, Bing, or other preferred search engine to locate trusted NTP …

920 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

17 Experts available now in Live!

Get 1:1 Help Now