Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm playing with a new Win2008 R2 server installed and hosted online with a direct connection to the web (i.e. no separate firewall in front of it).

The server is supposedly locked down with just RDP enabled. It's a fresh install, no software installed or roles/features enabled (apart from RDP). But in about 30 days there were 29,000 failed login attempts, but I was surprised to see a lot of "successful" ones too.

What are the anonymous logons, example below? Should I be concerned?

The workstation name and IP address changes frequently. In the 29,000 failed attempts it looks like bots/hackers are trying to guess the Administrator password.

Log Name:      Security
Source:        Microsoft-Windows-Security-Auditing
Date:          28/10/2011 04:45:11
Event ID:      4624
Task Category: Logon
Level:         Information
Keywords:      Audit Success
User:          N/A
Computer:      WIN-7I8SE0K3F9M
An account was successfully logged on.

    Security ID:        NULL SID
    Account Name:       -
    Account Domain:     -
    Logon ID:       0x0

Logon Type:         3

New Logon:
    Security ID:        ANONYMOUS LOGON
    Account Name:       ANONYMOUS LOGON
    Account Domain:     NT AUTHORITY
    Logon ID:       0x376b6c
    Logon GUID:     {00000000-0000-0000-0000-000000000000}

Process Information:
    Process ID:     0x0
    Process Name:       -

Network Information:
    Workstation Name:   SRV001
    Source Network Address:
    Source Port:        1242

Detailed Authentication Information:
    Logon Process:      NtLmSsp 
    Authentication Package: NTLM
    Transited Services: -
    Package Name (NTLM only):   NTLM V1
    Key Length:     0
share|improve this question
You might want to double check that firewall, the default is much more open than you might expect (personally I think firewalls should all default to "deny all" until configured, but the zillions of clueless admins in the world easily drown me complaining they can't figure out why their severs wont connect). –  Chris S Dec 8 '11 at 0:20
TBH I'm spooked enough as it is so going to wipe the server next week, rebuild it and have it behind a physical firewall. I can't find a satisfactory explanation (while ignoring the IIS/FTP references) –  Dan Dec 8 '11 at 16:55

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.