Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm running some windows servers which seem to be getting a lot of attempts to brute force the terminal services account. I've changed the administrator account name etc., but is there a way to block or tarpit multiple attempts to log into a remote or terminal service connection on a windows server?

share|improve this question

1 Answer 1

up vote 0 down vote accepted

There is no way to do this built in to Windows as far as I am aware. Your best bet is to change the RDP port to something non-standard (most RDP worms will simply target 3389) and, if possible, restrict RDP connections to VPN clients only.

You can change the rdp port in the registry at:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\TerminalServer\WinStations\RDP-Tcp\PortNumber

share|improve this answer
    
I considered this, but it wont stop all scripts as they will sniff out the port. It will certainly stop some BF attempts. –  Adrian Brown Jan 19 '12 at 11:10
    
You're correct in that sense but you will find the vast majority of brute force attempts will be from RDP worms. It's certainly not harmful to do so. Consider the time/overhead of scanning 65,535 ports looking for your RDP port just so it can try and brute force it and then multiply it by a couple of million hosts; almost all worms just don't do it. It's not worth it. No 3389? Move along, someone else will. –  nullity Jan 19 '12 at 11:12

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.