We have a cloud web server serving several e-commerce websites, which is running Windows Server 2008 R2 and IIS 7.5. We access the server via RDC.
After looking at the windows security log I can see many many login attempts, which are events:
- 4776 - The computer attempted to validate the credentials for an account.
- 4625 - An account failed to log on.
The username in the log is 'administrator', which we don't have, we use a different windows login as our admin, and we have a complex password. So I'm not worried about someone actually getting into our server, the thing that worries me is the server resources being used.
I know we can lock down RDC access using the windows firewall, so that only our IP is accepted. However I don't know how these login attempts are being done. I don't know if we can distinguish between these login attempts and normal HTTP traffic (our customers).
Can we use the windows firewall to block these login attempts, but not block our RDC access or our customers visiting our websites..?
UPDATE:
From the security log:
Event 4625 - An account failed to log on.
Subject:
Security ID: SYSTEM
Account Name: [our_server_name]$
Account Domain: Workgroup
Logon ID: 0x3e7
Logon Type: 10
Account For Which Logon Failed:
Security ID: NULL SID
Account Name: Administrator
Account Domain: [our_server_name]
Failure Information:
Failure Reason: Unknown user name or bad password.
Status: 0xc000006d
Sub Status: 0xc0000064
Process Information:
Caller Process ID: 0xa44
Caller Process Name: C:\Windows\System32\winlogon.exe
Network Information:
Workstation Name: [our_server_name]
Source Network Address: 198.50.172.109
Source Port: 62246
Detailed Authentication Information:
Logon Process: User32
Authentication Package: Negotiate
Transited Services: -
Package Name (NTLM only): -
Key Length: 0