Sorry if this was asked before, but I've looked at other questions and couldn't find a match.
I've been getting a lot of Logon Type 2 and 3 attacks on my Win Server 2008 VPS (from different IPs). I've been wondering what would be the best way to deal with these?
I've also noticed that attackers use the newly created administrator username (not the default "Administrator"), so they are somehow getting this information from my VPS Active Directory. I do have a RDP access enabled (but not through the standard RDP port). I'm aware this is a security problem, but I need the access.
As a side note: using ShieldsUp I've discovered that ports 135 (DCOM Service Control Manager) and 445 (Microsoft Directory Services) are open to the world. Could this be the way the attackers are getting my account names? Is it safe to close these ports without locking myself out of my VPS?
Thank you for any hints.
UPDATE: I've blocked ports 135 and 445 using custom firewall rules. I've also created a new test account on the machine to see if the attackers are still getting the AD data. As @syneticon-dj suggested, I've also turned off File and Printer Sharing. Now I'm waiting so see if anything new appears in the event log.
UPDATE 2: After running this configuration for a few days, I haven't noticed any new attacks in my event log. So I guess the ports blocking + disabling sharing did the trick!