Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Possible Duplicate:
Ban, slowdown or stop massive login attempts to RDP

I got some hackers constantly hitting my RDP and generating thousands of audit failures in event log.

Password is pretty elaborate so I dont think bruteforcing will get them anywhere. I am using VPS and I am pretty much a noob in Windows Server security (am a programmer myself and its my webserver for my site).

Which is a recommended approach to deal with this? I would rather block IPs after some amount of failures for example.

Sorry if question is not appropriate.

share|improve this question

marked as duplicate by mailq, EEAA, Iain, Scott Pack, sysadmin1138 Nov 21 '11 at 17:32

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

You should set up a VPN to your server and stop allowing RDP-in on your Windows Firewall from everywhere. Simply allow it on the private subnet that you would VPN into and the brute force attempts won't get the chance to succeed.

Allowing RDP from anywhere is bad bad bad.

share|improve this answer

A good way to block spam is to enable " Network Level Authentication " in remote desktop settings.

Another way is to permit only specific IP addresses from windows firewall, or ask from your Hosting Company to enable VPN if available.

Edit: Also you can change RDP Port to another ranger above 62000

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.