Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

i've been looking to a windows 8 web server eventlog on security option and i'm wordless with the ammout of audit failure logs.

what i'm trying to understand is that i've very, very much audit failures with the "Failure Reason: Unknown user name or bad password." i've seen too that failures are tries with multiples account names for multiple ports.

Some idea how can i prevent that? i've no idea how to start...

share|improve this question

closed as too broad by MDMarra, joeqwerty, mdpc, Ward, TheCleaner Aug 14 '13 at 17:29

There are either too many possible answers, or good answers would be too long for this format. Please add details to narrow the answer set or to isolate an issue that can be answered in a few paragraphs.If this question can be reworded to fit the rules in the help center, please edit the question.

1 Answer 1

up vote 1 down vote accepted

There will, even under normal operation, be audit failures constantly as services try legacy methods and such. However, if you see consistent remote authentication failures with random usernames or actual usernames, it's a bruteforce attack. The source port is probably not relevant.

If the server doesn't need to be listening to the internet on the service that is being attacked, it shouldn't. Firewall it. In fact, you should generally have a firewall around the server that denies access to everything except what is necessary. What specifically those things are depends very much on your environment and what the server is for (there is no One True Firewall Ruleset).

If the login attempts are on a service that you do need to be listening on, you should consider deploying an IPS of some kind to help limit the bruteforce. Keep in mind also that with strong passwords, the odds of an attack like this succeeding are comparable to the odds of winning a lottery.

If you notice that the failed attempts seem to be coming from your internal network and aren't related to someone fat-fingering a password or a service of some kind automatically trying to log in with the wrong password (a certain number of authentication failures are normal in all environments), investigate the possibility of a compromised host.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.