Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Possible Duplicate:
Ban, slowdown or stop massive login attempts to RDP

I have a Windows 2008 Server which is being attacked very hard.

Somebody is trying to use brute force to sign in to the server via remote desktop protocol. And looks like that attacker has a big range of IPs or bot net for attacks. Because, I have banned a thousands of his IPs and he is still able to continue attacking the server.

Please advise any way to reject any RDP sign in attempt if it fails 2nd time within one year from the same IP.

I think I need to create a rule to deny all attempts over the RDP protocol besides my IPs. The same rules for all other public resources, correct?

Highly appreciate any help.

Best regards.

share|improve this question

migrated from Sep 24 '11 at 23:27

This question came from our site for professional and enthusiast programmers.

marked as duplicate by GregD, Wesley, Ward, mailq, Zoredache Sep 25 '11 at 10:16

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

This question will be better answered in – Paulo Santos Sep 24 '11 at 23:25
did you piss somebody off? – tony roth Sep 24 '11 at 23:45
Which version of Windows Server? – Mark Henderson Sep 24 '11 at 23:52
For reference, this attack is widespread, it is likely that all visible RDP servers are being attacked. – Harry Johnston Sep 25 '11 at 7:39
Version: Windows server 2008 R2 Standard. I have only windows firewall :) Is it enough to be defended from the bad boys? Or I should install some other software? I can access the server via RDP, this is why I can't make a rule to deny RDP. – user963113 Sep 25 '11 at 10:25

Temporarily disable the RDP allow rule in your firewall. Other than that you'll just wind up spending countless minutes/hours blocking ip addresses.

share|improve this answer
Alternative; at a firewall in front of the server, set it to allow only from certain IP's. – Bart Silverstrim Sep 25 '11 at 0:46
That's a better solution. Thanks, Bart. – joeqwerty Sep 25 '11 at 1:09
Subset suggestion of your answer, @Joeqwerty. Endorse voting your answer up for it. – Bart Silverstrim Sep 25 '11 at 1:48
This is why we run RDP and SSH for our servers over a VPN. It eliminates bruteforcing from all creation and strictly limits access to company employees so we don't have to waste time trying to prevent this kind of thing. – Fiasco Labs Sep 25 '11 at 3:03
Or you change the listening port for RDP to something completely different. – mailq Sep 25 '11 at 9:52

Not the answer you're looking for? Browse other questions tagged or ask your own question.