Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Recently I acquired a dedicated server from a local ISP to play around with. As the tags suggest, its a windows server 2008 R2 machine.

I've only had it for a few days, and no real traffic is going to it yet. I haven't even deployed a "real" website to it yet. Just a silly page so that I could check IIS, my host headers, DNS records, etc are all configured correctly.

While playing around, I noticed a ton of Audit Failure entries in the event viewers security logs. It seems something is trying to access the administrator account, and failing. It smells like a brute force attack to me.

My ISP gave me the account details of the administrator account and I used those to RDP into the box, which I've heard is not the securest of situations.

I created myself another account and added myself to the administrator group, so im using that account to gain acceess to the machine now.

In response to all of this i used to generate me some 20 character length strong passwords and changed all of my account passwords, even the SQL sa user.

I also enabled the auto ban feature of FileZillaServer (my FTP server)

My questions: 1) how can i detect this kind of thing better? 2) how can i protect my server from unauthorized access better?

PS: I'm a software dev, not a sysadmin so please mind my server security idiot-ness-ness

share|improve this question

closed as not a real question by mgorven, Steven Monday, Ward, Khaled, Scott Pack Jun 11 '12 at 23:52

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

Start by disabling all the remotely-accessible services you don't need right now. You can always re-enable them in the future if you need them. – James Youngman Jun 10 '12 at 21:28
Someone is probably running a RDP script against your RDP port. Since you've already created a admin like user, disable the admin account. As long as they're trying to attack default accounts, I wouldn't worry. – jfalcon Jun 11 '12 at 6:26
Disabling the default admin account sounds like a good idea, thanks jfalcon! – HarveySaayman Jun 11 '12 at 7:30

Check that the firewall blocks everything but port 80... that is the first step.... If RDP is publicly accessible, that is a big problem (restrict RDP to just your source IP...)

share|improve this answer
The problem with restricting RDP to a source IP is that my IP address changes every time my internet connection is established. I'm accessing it over a home ADSL connection... – HarveySaayman Jun 11 '12 at 7:27
I'll definitely have a look at restricting all non essential services from the firewall though. Thanks – HarveySaayman Jun 11 '12 at 7:27
Restrict RDP or pay the price.... use a vpn to your firewall, and only allow rdp over the vpn.... do something, as the attacks will never stop... – samsmith Jun 11 '12 at 17:59

Not the answer you're looking for? Browse other questions tagged or ask your own question.