-1

Possible Duplicate:
Ban, slowdown or stop massive login attempts to RDP

I got some hackers constantly hitting my RDP and generating thousands of audit failures in event log.

Password is pretty elaborate so I dont think bruteforcing will get them anywhere. I am using VPS and I am pretty much a noob in Windows Server security (am a programmer myself and its my webserver for my site).

Which is a recommended approach to deal with this? I would rather block IPs after some amount of failures for example.

Sorry if question is not appropriate.

Improve this question
0

2 Answers 2

Reset to default
3

You should set up a VPN to your server and stop allowing RDP-in on your Windows Firewall from everywhere. Simply allow it on the private subnet that you would VPN into and the brute force attempts won't get the chance to succeed.

Allowing RDP from anywhere is bad bad bad.

Improve this answer
2

A good way to block spam is to enable " Network Level Authentication " in remote desktop settings.

Another way is to permit only specific IP addresses from windows firewall, or ask from your Hosting Company to enable VPN if available.

Edit: Also you can change RDP Port to another ranger above 62000

Improve this answer

Not the answer you're looking for? Browse other questions tagged .