Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

While looking in Terminal Services Manager on one of my SQL boxes, I noticed that there are seemingly many attempts to remote to the machine while I was connected:

One minute...
One minute
And the next...
And the next

I'm not seeing anything that seems to match this activity in the event viewer, and it's continuing. Where might I look to find out where these are coming from and what might be going on?

share|improve this question
Check your firewall logs. That appears to be a brute force attempt to log on to the server via RDP. Do you allow RDP connections to the server through your firewall? – joeqwerty Apr 2 '13 at 15:12

If someone is failing to authenticate then you should find information about that in the security event log. If all they are doing is making a connection but not passing credentials then that won't show up really anywhere in Windows (that I'm aware of).

Like @joeqwerty said, if this machine is accessible from the public Internet then check the firewall logs to see what they say. Also close the connection from the public Internet as that's just asking for trouble. Using a VPN then RDPing into the SQL Server is a much more secure option.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.