Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

While looking in Terminal Services Manager on one of my SQL boxes, I noticed that there are seemingly many attempts to remote to the machine while I was connected:

One minute...
One minute
And the next...
And the next

I'm not seeing anything that seems to match this activity in the event viewer, and it's continuing. Where might I look to find out where these are coming from and what might be going on?

share|improve this question
1  
Check your firewall logs. That appears to be a brute force attempt to log on to the server via RDP. Do you allow RDP connections to the server through your firewall? –  joeqwerty Apr 2 '13 at 15:12
add comment

1 Answer

If someone is failing to authenticate then you should find information about that in the security event log. If all they are doing is making a connection but not passing credentials then that won't show up really anywhere in Windows (that I'm aware of).

Like @joeqwerty said, if this machine is accessible from the public Internet then check the firewall logs to see what they say. Also close the connection from the public Internet as that's just asking for trouble. Using a VPN then RDPing into the SQL Server is a much more secure option.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.