Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

The Event Viewer for my Windows Server 2003 machine is flooded with these 540 login attempts from IP addresses in foreign countries. It looks like somebody is trying to access my machine - what sort of logon attempt could this be?

Is there anything I can do besides blocking the subnet with my hardware firewall?

Successful Network Logon:
User Name:  
Logon ID:       (0x0,0xAFB92F)
Logon Type: 3
Logon Process:  NtLmSsp 
Authentication Package: NTLM
Workstation Name:   MATE-5BAD844B02
Logon GUID: -
Caller User Name:   -
Caller Domain:  -
Caller Logon ID:    -
Caller Process ID: -
Transited Services: -
Source Network Address:
Source Port:    0
share|improve this question
These can indeed be logon attempts. My next question is do you have this server firewalled? – GregD Apr 6 '11 at 15:34
Yes, I am running a hardware firewall and just started adding the offending subnets to an ACL. Is that the best way to handle this? – user66827 Apr 6 '11 at 15:36
Are you allowing remote desktop from the internet? – GregD Apr 6 '11 at 15:37
RDP is restricted to our office only, everything else on 3389 is blocked. – user66827 Apr 6 '11 at 15:39
What ports do you have open? Whether you can block this depends on the purpose of the server, but you should be blocking all ports coming in from the net, then allowing only specific, necessary ones (so that you know where to look when this happens). Ports to look at are all of the microsoft services. 445, 135.. 389 if it's a DC, 1433 if it's a MSSQL server, etc... Blocking the subnet is pointless, as a majority of automated attacks come from botnets with nodes all over the world. – Shane Madden Apr 6 '11 at 15:51
up vote 1 down vote accepted

Event ID 540 for Logon Type 3 is a successfull network logon. Do you have IIS installed on the server running a publicly accessible web site? If so, that's the most likely source of the logons.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.