Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I was just going through the logs of one of my servers and I noticed there are a ton of failed logon attempts for username Administrator, owner and Admin. I assume that these are bots since there is almost one every second, but my question is what do you normally do about this?

I am new to server security, but from what I have been reading most people don't seem too concerned with this type of thing.

When you try to remote desktop into a windows system, don't you only have a few tries before being locked out for a bit? I have 63 minutes worth or failed logon attempts every ~1.3 seconds from the same IP address 69.41.252.68.

share|improve this question
add comment

1 Answer

up vote 5 down vote accepted

Account Lockout Policy settings aren't enabled by default. You'll need to manually enable them. If this is a standalone server (it sounds like it is) you can enable Account Lockout Policy settings by editing the Local Security Policy from within Administrative Tools. If this server is joined to a domain you can enable Account Lockout Policy settings by editing the Local Security Policy from within Administrative Tools or by using Group Policy within the domain.

It sounds like these events are being generated by incoming RDP connection attempts (although you haven't specified that). You can take a number of approaches to dealing with this:

A. Block the offending ip address(es) at your network router or firewall.

B. Block the offending ip address(es) in the Windows Firewall by setting the Scope of the RDP-in rule to allow connections only from a defined set of ip addresses or networks.

share|improve this answer
    
Is this a fairly common issue, having a lot of bot attempts? I didn't think of doing B creating an IP safe list, but that's a good idea. –  Garrett Fogerlie Aug 13 '12 at 1:59
2  
Yes, I think it's fairly common. –  joeqwerty Aug 13 '12 at 2:03
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.