Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

On a windows server 2008 enterprise edition, nothing has changed but recently there are many csrss.exe, LogonUI.exe, svchost.exe and winlogon.exe processes in task manager.

Does it mean some remote sessions are active (server has compromised) or what ?


I checked event logs and it seems someone is trying to logon with Administrator user. It seems an automated tool. How can I defend (block hacker IP...) ?

Here is the log:

An account failed to log on.


Logon Type:         10

Account For Which Logon Failed:
    Security ID:        NULL SID
    Account Name:       Administrator
    Account Domain:     ...

Failure Information:
    Failure Reason:     Unknown user name or bad password.
    Status:         ...
    Sub Status:     ...

Process Information:
    Caller Process ID:  ...
    Caller Process Name:    C:\Windows\System32\winlogon.exe

Network Information:
    Workstation Name:   ...
    Source Network Address: ...
    Source Port:        ...

Detailed Authentication Information:
    Logon Process:      NtLmSsp
    Authentication Package: NTLM
    Transited Services: -
    Package Name (NTLM only):   -
    Key Length:     0

This event is generated when a logon request fails. It is generated on the computer where access was attempted.
share|improve this question
Who are the owners of all of the different processes? Is this a terminal server by chance? – squillman Aug 23 '11 at 20:45
@squillman: All processes are running under system account. – Xaqron Aug 23 '11 at 20:47
up vote 3 down vote accepted

Logon Type 10 is a remote interactive logon, meaning someone is trying to log on via RDP. Do you allow RDP connections to the server through your firewall?

share|improve this answer
Yes, I allow RDP since I should control server myself. Unfortunately I don't have a valid (permenant) IP address for creating inbound rule but I have blocked attacker IP addresses manually. Is there any way to do it automatically based on frequency on failed logins ? – Xaqron Aug 24 '11 at 0:19
You could lock out the account after x number of failed logins but then you'll wind up locking yourself out. – joeqwerty Aug 24 '11 at 0:38
I need blocking IP after x failed logins. Attacker even uses invalid usernames but this utilizes server resources specially because he does it in a DoS way (may concurrent requests). – Xaqron Aug 24 '11 at 0:47
You could disable RDP access through the firewall and set up a VPN and access the server via the VPN connection. – joeqwerty Aug 24 '11 at 0:49
@ joeqwerty: I do it right know. The problem is if VPN server goes down I cannot access my server but for now it seems the best solution. Thanks. – Xaqron Aug 24 '11 at 0:52

Many windows services use svchost.exe. You can look into your services.msc node to see them. Just double click some of the services like dhcp client or dns client to see the executable that windows will launch for the service. If you are worried about terminal services or remote desktop connections you can go to the users tab in task manager to see if there is someone currently logged in. This only works for the microsoft remote tools of course.

share|improve this answer
I have already checked this from Users tab of TaskManager. Nobody is logged-in. I'm wondering why there are dozen of these processes there (nothing has changed on server and I have never encounter this situation). – Xaqron Aug 23 '11 at 20:51
Does this server have Citrix installed by any chance? – Stephen Short Aug 23 '11 at 21:02
No, I found something new. Question updated. – Xaqron Aug 23 '11 at 21:05

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.