Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Remote session from client name a exceeded the maximum allowed failed logon attempts. The session was forcibly terminated.

One of the servers are being hit by a dictionary attack. I have all the standard security in place (renamed Administrator, etc.) but want to know is there a way to limit or ban the attack.

Edit: The server is remote only. I need RDP to access it.

share|improve this question
    
Protected question as its quite popular and gathering a few low-quality answers. –  RobM Dec 9 '12 at 17:36

7 Answers 7

up vote 27 down vote accepted

Block RDP at the firewall. I don't know why so many people allow this. If you need to RDP to your server, setup a VPN.

share|improve this answer
3  
@EduardoMolteni: As Jason states, block RDP at the firewall and use a VPN. –  GregD Sep 23 '11 at 15:10
4  
@Eduardo - The correct thing to do is VPN in. That would still give you the access you need. If you insist on allowing RDP access to your server, you do so at your own risk. There is no popular tool or method out there for limiting these attacks. Good sysadmins just block the traffic. If you'd like to give it a shot, maybe you can modify Evan's program here serverfault.com/questions/43360/… to look for RDP connections. I'm not sure if that's even an option but it's probably your closest chance. –  Jason Berg Sep 23 '11 at 15:14
2  
@EduardoMolteni: You've gotten the wrong impression if you think we're "not nice people" or "mad" and if English isn't your first language, perhaps those aren't the first judgments you should come to? I just simply wondered why several people had mentioned setting up a VPN and you kept saying, "I need RDP to access it". You can still RDP through a VPN connection... –  GregD Sep 23 '11 at 16:14
5  
Not sure why you are so extremely against permitting RDP. The encryption isn't that bad, the same as https. By setting up a VPN all you are basically doing is changing the object an attacker would need to brute force. If the VPN uses simple password authentication integrated into the same authentication system as the RDP host, then you really haven't changed much at all. –  Zoredache Sep 23 '11 at 16:21
5  
I'm amazed that people would wrap one remote access service in another when there is so little benefit. VPN can be brute forced like anything else. Locking out accounts based on RDP attempts is just silly. Rather set up so 150 incorrect passwords from any given IP within 24 hours blocks that IP. If this is such a huge problem, don't use passwords. –  Alex Holst Sep 23 '11 at 20:40

The only thing I can think of why your server is getting hit with a massive amount of RDP attempts is that you can RDP to it from the internet. Disable this access from the internet and you should be fine. Use a VPN like everyone else if you need to RDP to the server from the outside. If these are internal attempts, then you have a bigger problem that likely involves somebody getting terminated for trying to dictionary attack an internal server...

share|improve this answer
    
or there's malware on the network. –  gravyface Sep 23 '11 at 14:58
    
I need to be able to RDP from the internet. Just want to limit so you can't try to login several times per second –  Eduardo Molteni Sep 23 '11 at 15:00
1  
@Eduardo - It's already been said twice. Put something in between the Internet and this server. Be it VPN, an SSH tunnel, TS Gateway, etc. Hell, if you are concerned this is an automated attack resulting from port scan, move the RDP port to something less obvious. –  Aaron Copley Sep 23 '11 at 15:09
2  
@EduardoMolteni: With VPN you can still RDP from the internet. Why do you keep glossing over the VPN part? –  GregD Sep 23 '11 at 15:11
    
@Aaron: Don't get mad. Just learning the options here. –  Eduardo Molteni Sep 23 '11 at 15:12

You could change the port to a non-defaultRDP port. This will still allow you to connect but make it slightly harder for someone to find RDP on your machine.

http://support.microsoft.com/kb/306759

share|improve this answer
    
I have RDP setup on my home network... but I have it changed at the router to a non-standard port. was going to suggest at-least changing the ports, as I think that would thwart all but the absolutely most dedicated hacks. –  WernerCD Sep 23 '11 at 18:40

Theoretically you would accomplish this using a tool called an intrusion prevention system (IPS). Ideally this device would be an appliance outside of your Windows box. Building a rule in a Linux iptables firewall to block brute force traffic is pretty easy.

In a separate question Evan mentions he developed a script which would manage the Windows firewall based on failures in OpenSSH. You may be able to adapt his code to apply here, if you must do this on the Windows box itself.

share|improve this answer

Change the port and virtually all attacks will stop.

Attacks are usually not directed to you specifically but to all IPs. So they won't try non-default ports because it's simply not worth it; trying the next IP has chances orders of magnitude greater than trying the next port.

share|improve this answer
16  
When being hunted by lion, you must only outrun the slowest gazelle to survive. –  IslandCow Sep 23 '11 at 16:35
    
The instruction on how to do it can be found at support.microsoft.com/kb/306759 –  mailq Sep 25 '11 at 10:00

If you know the IP addresses of the PCs that need to RDP to this server over the internet, configure your router/firewall to only allow RDP traffic from those IPs or IP ranges. If the incoming PCs are on DHCP from their ISP, putting the ISP's IP range(s) in to your firewall would at least block most of the random login attempts.

share|improve this answer

Ban the IP's using WinBan and the rdp mdule.

share|improve this answer

protected by RobM Dec 9 '12 at 17:35

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.