Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a Windows Server 2008 R2 with a valid IP, and recently I've found hundreds of unknown and strange RDP successful logins logged in EventViewer. Here are some details:

  1. They are not similar to normal logins, they happen like every second in a while even when I myself am logged in to the server.
  2. Event reads "Remote Desktop Services: User authentication succeeded" in "Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational", Event ID 1149
  3. They seem to use some random user accounts without a domain name. I'm pretty sure that I don't have those local user accounts, and the server doesn't belong to any domain. Legitimate RDP logins have a valid user account and workgroup name, but those logins use unknown user names without any workgroup.

Support staff couldn't help me and I'm very curious what are these strange logins. Are they some sort of brute force attack? so why does it read "Successful"? Am I being hacked? Why do they keep happening continually?

EDIT: I like to point out again that these accounts DO NOT EXIST on the server. I wonder why should there be a successful RDP login from a user account which does not exist. (e.g. has no user profile folder)

share|improve this question
    
Can you share the Addresses please? (or at least thes first 2 octets. So we can work out if this is external or internal. –  t1nt1n Nov 17 '11 at 12:28
    
I am having the exact same problem. I am sure the logged accounts aren't valid against my local system. I accidentally stumbled on the rdp log and there are no other symptoms my system is compromised. The connection are comming from all over the world: Brazil, USA, UK etc The username that are being used are: test, user, admin, administrator Hopefully someone has some more informations on this –  user102152 Nov 25 '11 at 20:10
    
I found the same messages today. When checking the Security log it looks like those connections were rejected by the server lateron. It is strange that the RemoteConnectionManager login shows them as success while the audit shows them als failed. Also these connections do not show up in the LocalSessionManager log, that one only shows successful RDP connections (and not the strange ones). Did you ever find out more about this problem? –  Gertjan Dec 12 '11 at 10:13
    
All the Addresses are external, they are from very different IP ranges, as Liam mentioned. I finally blocked all unknown IPs using firewall, but I didn't find out where they came from and why this happened. –  Yousef Jan 3 '12 at 14:13

3 Answers 3

Just because no user directory exists does not mean that users do not exist. Check the local user and service accounts in the MMC to validate that they really do not exist.

These symptoms are usually a sign of an RDP worm traversing a network. Also validate that any anti-malware utility you're running is up to date and run a full scan on that machine. If there is an RDP worm and there were successful logins then chances are that you're already infected.

share|improve this answer

I had exactly similar problem and to reproduce the results all I had to do was connect to remote machine using a rdp client that don't have Network Level Authentication(ubuntu rdp client) and entering an imaginary username. I was presented with a login screen and the event was logged in event viewer as successful authentication of remote desktop. However it was not possible to login using the imaginary account. If it is possible I suggest you turn on network level Authentication for Remote Desktop.

share|improve this answer

The source network address should give you an idea where these connections come from. Maybe you can then easier troubleshoot the problem. Make sure you have security enabled for RDP sessions. And yes, it could be that you are hacked.

share|improve this answer
    
Well they are not from a single network but from many different IP ranges. –  Yousef Nov 17 '11 at 12:11
    
There is a semi-recent network worm that attacks through RDP. What are the account names that connect? –  Top__Hat Nov 17 '11 at 12:48

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.